re: fix the wrong ISL conditions -- the cause was a coroutine boundary, not the filter

The listing showed end_coroutine as the left-hand side of 34 comparisons disc-wide.
That is impossible -- it returns no value a script can test -- so it was the bug
reporting itself.

The recorded fix ("set special[0] only for built-ins that write [phase+164]") is
REFUTED.  end_coroutine's handler 0x82272624 is `addi r11,r0,1 ; addi r3,r0,3 ;
stw r11,164(r31)` -- it DOES write [phase+164], so that filter would have kept it.
Reading the handler before writing the filter is what caught this.

The real cause: end_coroutine returns 3, which DESTROYS the thread.  Execution does
not continue past it, so the instructions following it in the flat stream belong to
a different routine and every tracked value is stale.  The linear walk that makes
the decode possible is exactly what walks across that boundary.

A/B over all 28 stages, 7563 sites, resetting the tracker at end_coroutine:
  sites whose operands change            34  (0.45%)
  LHS = end_coroutine, before -> after   34 -> 0
  left as an explicit unknown            34  (0.45%)

The two counts being equal is the result: the leak was confined to exactly the sites
that displayed the impossible value, so the other 7529 conditions were never
affected.  Those 34 now print "<unknown: reached after a coroutine boundary>".

Not done, and said so: their RHS is still exact and the LHS is recoverable by seeding
the tracker at coroutine entries, whose targets are staged slot 0 of start_coroutine.

data/isl-stage02-conditions.txt regenerated; calls and phase-ends both byte-identical.

tools/re-capture/isl.py

@@ -368,6 +368,11 @@ def conditions(b, sym1=None, sym2=None):
     MEASURED, and this is why the model is trusted: across all 28 stages
     push and pop balance at 1877 each with ZERO underflows, and in Stage 02
     all 319 `pop.i` sites are immediately followed by `cmp.i`.
+
+    The tracker resets at `end_coroutine`, which destroys the thread.  A/B over
+    all 28 stages: exactly 34 of 7563 sites change, and all 34 are the ones that
+    previously reported the impossible `end_coroutine` as a left-hand side.  They
+    become an explicit unknown rather than a wrong answer.
     """
     bases = phase_bases(b)
     sp, loc, stack = {}, {}, []
@@ -412,6 +417,14 @@ def conditions(b, sym1=None, sym2=None):
                 args.append(v)
             sp[0] = '%s(%s)' % (nm, ', '.join(args))
             loc = {}
+            if words[0] == 11:
+                # `end_coroutine` returns 3, which DESTROYS the thread -- execution
+                # does not continue past it, so the instructions that follow in the
+                # flat stream belong to a different routine and every tracked value
+                # is stale.  Without this reset, 34 sites disc-wide reported
+                # `end_coroutine` itself as the left-hand side of a comparison,
+                # which is impossible: it returns no value a script can test.
+                sp, loc, stack, pend = {}, {}, [], None
         elif op == 21:
             stack.append(sp.get(1))
         elif op == 22:
@@ -423,7 +436,10 @@ def conditions(b, sym1=None, sym2=None):
         elif op in REL and pend:
             ph = sum(1 for x in bases if x <= off)
             tgt = bases[ph - 1] + words[0] if words else None
-            out.append({'off': pend[0], 'phase': ph, 'lhs': pend[1],
+            lhs = pend[1]
+            if lhs.startswith('special['):
+                lhs = '<unknown: reached after a coroutine boundary>'
+            out.append({'off': pend[0], 'phase': ph, 'lhs': lhs,
                         'rel': REL[op], 'rhs': pend[2], 'branch': off,
                         'target': tgt})
             pend = None