word_source: repair DECAY-RATE@ overflow guard and remove dead shadowed registrations

DECAY-RATE@ (physics_freeze_words.c) pushed to the data stack with no
capacity check and no prior pop to make room, unlike its neighbors in
the same file -- the one live, unconditional missing-guard bug the
Isabelle sweep's ~15 candidate findings reduced to once checked against
vm_push()'s real internal bounds check (see proof/FINDINGS.md SS2).

Removed dictionary_manipulation_words.c's [ ] STATE and defining_words.c's
DEFER IS DEFER@ (plus the now-orphaned defining_runtime_defer helper) --
all confirmed permanently shadowed by later dictionary registrations
(defining_words.c and defer_words.c respectively), per FORTH's
newest-first lookup. No behavior change: the removed code was already
unreachable.

Verified: hosted `make` builds clean under -Wall -Werror; the hosted
self-test suite passes 965/965 implemented tests with no regressions.
Three-architecture QEMU acceptance boot, all clean to ok> with an
identical dict_hash=0x24b4279f0670aa3a across amd64/aarch64/riscv64 and
identical 1003/965/0/0 test totals -- logs attached.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

src/word_source/physics_freeze_words.c

@@ -370,11 +370,16 @@ void forth_ALL_HEATS(VM *vm) {
  *
  * Stack effect: ( -- rate )
  *
- * @param vm Active VM; no-op if @c vm->error is set
+ * @param vm Active VM; sets @c vm->error = 1 on stack overflow
  */
 void forth_DECAY_RATE_FETCH(VM *vm) {
     if (vm->error) return;
 
+    if (vm->dsp >= STACK_SIZE) {
+        vm->error = 1;
+        return;
+    }
+
     /* Stack: ( -- rate ) */
     vm->data_stack[vm->dsp++] = (cell_t)DECAY_RATE_PER_US_Q16;
 }