A return deferred to finally survives an exception from that finally and is applied by an unrelated finally later #370

Summary

A return deferred to a finally block is stored in a single VM-wide slot
(VM._deferred_return) and is only cleared when a FINALLY_END consumes it. If
the finally block raises instead of completing, the deferred return is never
consumed — it stays pending and is applied by whatever unrelated FINALLY_END
runs next, in a completely different part of the program.

Found while fixing #361; the two share the same state machine.

Reproduction

fn f() { try { return 1 } catch e { print("f catch") } finally { throw "x" } }
try { f() } catch e2 { print("caught: \(e2.message)") }
try { print("body") } catch e3 { print("e3") } finally { print("fin") }
print("after")

Actual (v4.1.1 and dev source, CLI and embedded):

Runtime error at ...:3:64: FINALLY_END deferred return outside function
Stack trace:
  at <main> (...:3:64)
caught: x
body
fin

exit code 1. Expected:

caught: x
body
fin
after

The second try/catch/finally is unrelated to f() — it has no return at
all. It inherits f's stranded deferred return of 1, tries to pop a frame
that does not exist at module level, and dies with an internal VM message.

Expected behavior

An exception raised inside a finally supersedes a return that block was
about to complete. The pending return should be discarded when the exception
escapes the region that owes it, and unrelated finally blocks must never see it.

Fix direction

handle_exception should drop deferred state owned by a finally region it has
unwound out of. The region can be identified by the handler-stack depth recorded
when the return was deferred: if the handler receiving the exception sits outside
that depth, the region will never reach its FINALLY_END, so the pending action
is dead. A try nested inside the finally that catches its own error is at
the same depth or deeper and must not clear it.

Affected versions

v4.1.1 (current published) and dev source. Reproduces under CLI and embedded
NodusRuntime. Predates 4.1.1.