arm: Account for Thumb instruction widths in IT lookback

[zardus]

THIS MESSAGE WAS GENERATED BY AN AUTOMATED PROCESS

Thumb block lifting can incorrectly preserve ITSTATE after a mixed-width IT group has ended, because the lookback treats every guarded instruction as four bytes. This produces a synthetic conditional exit for the first instruction after the group.

The ARM decoder now walks each possible IT candidate forward using exact Thumb instruction widths, and continues past expired candidates so a halfword inside a 32-bit instruction cannot hide an older active IT.

The dependent PyVEX change adds regressions from a public newlib memchr sequence and conservative boundary cases. Validation: #92 (comment).

sync: angr/pyvex#568

[zardus]

THIS MESSAGE WAS GENERATED BY AN AUTOMATED PROCESS

Validation record for head 881703eda064a67a803cf51974c992286a8bdf4f against baseline 875f7c9a5f6be621b4f000c29c016e15ddf32207.

• Native build: make -f Makefile-gcc -j1 all — passed; guest_arm_toIR.c compiled without a new diagnostic
• Downstream regression: python -m pytest -q tests/test_arm_postprocess.py in the coordinated PyVEX checkout — 6 passed; the baseline emits a false exit to 0x80024eb, while head emits none
• Downstream full suite: python -m pytest -q in PyVEX — 68 passed
• Lint/type: all configured PyVEX pre-commit hooks passed; merge-base Pylint/Pyright comparison passed with 10.00 -> 10.00 and improved type badness
• Workspace gate: adopted PyVEX/VEX only — workspace checks 9/9, test-input policy passed, all 12 feature-instance scenarios passed, PyVEX 68 passed; unadopted ecosystem repositories were not tested
• Reproducer: DecBench 4b42a0dc6158913db0648a9123e76d6ddd9ab9cf, O2-noinline/libopencm3/adc-dac-printf.elf SHA-256 9145af6d42a26620009ffd84334a012d0a118b55302287913efb9f8a52615d19, Thumb memchr at 0x8002451, target block 0x80024e9
• Behavioral A/B on angr 5d32d30d6da9e017484b11363de5f778f21c697e: baseline has one ITSTATE read, one exit to 0x80024eb, and an undefined goto under SAILR and Phoenix; head has none, with identical 17-node/25-edge function CFG topology

Caveat: the executable regressions live in the dependent PyVEX pull request; this repository's local gate is its native build.