refcount_insertion: fix model reg mismatch in env bit assignment

Env initialization used hir_chase_assign (only follows Assign instrs)
to compute model registers for support bit assignment. But the pass
processing uses phx_rc_model_reg (follows ALL passthroughs except
GuardIs). When a phi input goes through a non-Assign passthrough
(CheckField, CheckVar, etc.), the two functions return different model
registers. The env assigns a bit for the chase_assign model, but the
pass looks up using the modelReg model — returning -1 (not found).

This -1 was then cast to size_t (becoming SIZE_MAX) and passed to
phx_bv_set_bit, causing out-of-bounds memory access → SIGSEGV.

Fix: use phx_rc_model_reg in env initialization, matching the pass.

Bug python#17: triggered by nbody's phi inputs through non-Assign passthrough
instructions (list subscript operations producing CheckVar intermediaries).

Author: SonicField

Python/jit/hir/refcount_env_c.c

@@ -65,10 +65,12 @@ static int phi_use_cmp(const void *a, const void *b) {
     return 0;
 }
 
-/* ---- modelReg: chase Assign chains ---- */
+/* ---- modelReg: chase through passthroughs (matches phx_rc_model_reg) ---- */
+
+extern void *phx_rc_model_reg(void *reg);
 
 static void *model_reg(void *reg) {
-    return hir_chase_assign(reg);
+    return phx_rc_model_reg(reg);
 }
 
 /* ---- Public API ---- */