d204 push-after-dangling-write deep-clears (WS2 residue)

Root cause

Source

// SPDX-License-Identifier: MIT
pragma solidity 0.8.35;

/* ===ARENA-MANIFEST===
{
  "deploy": { "contract": "C", "args": [], "value": 0 },
  "entry":  { "function": "run", "args": [] },
  "feature": "push-after-dangling-write-deep-clears",
  "note": "A storage pointer to a dynamic-array element, then pop, then a write THROUGH the (early-bound) pointer to the now-freed slot, then push. solc+EVM: push only bumps the length and does NOT zero the regrown element, so the dangling write survives and arr[1].a reads back 5. solidity-lean: push deep-clears the new element, returning 0. Only observable now that WS2 early-binding (main 8b10a95) makes the dangling write actually land."
}
===END-ARENA-MANIFEST=== */

contract C {
    struct S { uint256 a; }
    S[] arr;

    function run() external returns (uint256) {
        arr.push();
        arr.push();
        S storage p = arr[1];
        arr.pop();
        p.a = 5;
        arr.push();
        return arr[1].a;
    }
}