Refactor phase 3a: one map-ir-children combinator for the IR rewrite walks (jolt-26dm)

Six bottom-up IR rewrites (const-fold, inline-node, subst, flatten-lets,
subst-lookup, scalar-replace) each hand-listed every op's child positions —
~250 lines of identical "recurse children, rebuild" arms that had to be kept in
sync whenever an op was added. Extract one map-ir-children into ir.clj that
knows each op's child layout; each walk keeps only its genuine specials
(const-fold's invoke/if, inline-node's invoke, subst's local/let alpha-rename,
scalar-replace's invoke/let folds) and delegates the rest.

The combinator is total over the op set, so the walks are now total too: a
couple soundly gain coverage they previously skipped (const-fold now folds
inside :try; subst-lookup now recurses :def inits, which fixes a latent dangling
ref where a dropped const-key-map binding was referenced inside a def). These
are sound — all six are result-preserving optimizations — and 3-mode conformance
+ fixpoint confirm identical program behavior.

map-ir-children is shape-preserving for :try (recurses :catch-body/:finally only
when present, never assoc's nil) so it can't turn a struct node into a phm.
Written with cond/get only, matching the passes' tier, so no new load-order dep.

Predicates (body-closed?/pure?/local-escapes?), the type-threading infer, and the
Janet backend emit stay as-is: their conservative :else defaults / [type node]
threading / host language don't fit a node-rebuilding combinator.

Adds ir-passes-test coverage for folding reaching fn/loop/try bodies. Full gate
green (conformance x3, suite >=4695/88, fixpoint stage1==2==3, inline-sra + devirt).

test/integration/ir-passes-test.janet

@@ -39,4 +39,13 @@
 # broader matrix; this pins a couple end-to-end)
 (assert (= 6 (api/eval-string ctx "(+ 1 2 3)")) "folded eval")
 (assert (= :yes (api/eval-string ctx "(if (< 1 2) :yes :no)")) "folded if eval")
+
+# Folding reaches into every op's children via map-ir-children (phase 3a) — it is
+# now total, so a constant nested in a fn arity / loop / try body folds too
+# (const-fold previously passed :try through unfolded). Sound: folding preserves
+# runtime results regardless of position, so these eval end-to-end (3-mode
+# conformance covers the broader matrix).
+(assert (= 3 ((api/eval-string ctx "(fn [x] (+ 1 2))") 0)) "folded fn arity body eval")
+(assert (= 10 (api/eval-string ctx "(loop [i 0] (if (< i (* 2 5)) (recur (inc i)) i))")) "folded loop eval")
+(assert (= 5 (api/eval-string ctx "(try (+ 2 3) (catch Throwable e 0))")) "folded try eval")
 (print "IR passes passed!")