…6828)

## Summary

`GuardType` narrows only its result id, not the original input. 
A later guard on the same input therefore looks unfoldable to `fold_constants` even though the side-exit semantics already prove the narrower type.
Canonicalize rewrites later uses to the most recent `Guard*` result, making the redundant guard foldable.
For example, in this CFG-join shape:

 ```ruby
  def test(n, cond)                                                                                                           
    if cond   
      a = n + 1
    else                                                                                                                      
      a = n + 2
    end                                                                                                                       
    n + a   # `n` gets a redundant Fixnum guard here
  end
 ```

This PR adds a block-local HIR `canonicalize` pass that walks each block in RPO and rewrites every operand through union-find plus a per-block `rewrite_map` keyed on the most recent `Guard*` for that value. 
After canonicalization, `infer_types` can narrow merge-block parameter types and `fold_constants` can then drop the redundant guards in both shapes above.

Inspired by Cranelift's canonicalize https://cfallin.org/blog/2026/04/09/aegraph/

Fixes: Shopify#978

## Benchmarks

Bench (arm64 linux devcontainer, ruby/ruby-bench, warmup=10 bench=20)

```
  Throughput              master/staged
    lobsters              1.021 (+2.1%, within ±3-6% noise)
    railsbench            1.012 (+1.2%, within ±3-4% noise)

  --zjit-stats            lobsters / railsbench
    code_region_bytes     -1.1%   / -1.0%   (redundant CFG-join guards still removed)
    guard_type_count      -29.4%  / +30.1%  (railsbench likely single-run noise) ⚠
    compile_hir_time      +14.6%  / +13.7%  (canonicalize_time: 67ms / 31ms)
    invalidation_time      ±0%    /  ±0%
```