State/Exn import registration never walks handler clause bodies, state-init expressions, or i32_pair cells — check-green programs fail with unknown func/tag

## Repro `_scan_body_for_state_handlers` (vera/codegen/compilability.py) recurses only into `HandleExpr.body` — never `clauses[*].body`, `clauses[*].state_update`, or `state.init_expr`. Any State/Exn family whose only use sits inside a clause body or an init expression is never registered, while the lowering emits its calls anyway: - a `handle[State<Nat>]` nested inside a `State<Int>` handler's get-clause body → `unknown func $vera.state_push_Nat` at the whole-module WAT compile - the same nesting inside the outer handler's **init expression** - `handle[Exn<Int>]` inside a State clause body → `unknown tag $exn_Int` Separately, the body scan silently skips i32_pair registration, so `handle[State<String>]` in a **pure** fn (the E607 gate covers only the declared-effect path) is check-green invalid WASM. ## Notes Pre-existing (verified identical at PR #1202's parent). Loud at compile, never silent. Surfaced by PR #1202's round-3 adversarial review (clause-env lens, F1+F3) — these shapes are exactly the ones the declaration-env clause compilation makes semantically well-defined, so the registration walk is the remaining blocker. Fix shape: extend the scan to clause bodies/state-updates/init exprs, and route the body-scan's cell gate through the same E607-style diagnostic instead of a silent skip.