L3 data-dependence completeness: decide L3 vs L4 for three gaps, and add the go/ssa check #22

Is your feature request related to a problem? Please describe.
L3's data dependence (ddg) is incomplete for three patterns, so a slice or taint query at level 3 can miss a real flow. All three are documented in docs/design/specs/v2-l3-l4-dataflow.md §4.5 "L3 precision".

1. Closure writes. A closure that writes a variable it captured, e.g. func(){ x = secret }() or once.Do(func(){ x = secret }), defines nothing in the enclosing function.
2. Value structs. A value-typed struct argument or receiver that holds a slice or map is not treated as written by the call.
3. Deferred operands. A deferred call reads its receiver and arguments as they are at function exit, not as they were when the defer ran. Reassigning the variable after the defer adds a spurious edge and can hide an earlier definition.

Separately, the spec calls for a non-gating comparison of L3's def-use against go/ssa as an independent answer key (was #23). It was not built:

• The CFG has a differential test against x/tools/go/cfg.
• Control dependence has a brute-force reference.
• Data dependence has only hand-derived fixtures.

Describe the solution you'd like

1. Decide, per pattern, whether L3 models it or leaves it to L4 (capture formals and the points-to pass). Amend the spec accordingly.

   • For pattern 3, bind the deferred call's operands at registration, e.g. through the existing <defer>:<key> pseudo-path.

2. Add the go/ssa differential:

   • Build go/ssa for the fixture corpus.
   • Map SSA def-use pairs to L3 body nodes.
   • Report, without asserting, the differences.

   This is how to find any further gaps of this kind and confirm the fixes. go/ssa is also the L4 substrate, so the mapping layer can be reused there.

Describe alternatives you've considered

• Leaving all three patterns to L4. That keeps L3 simple, but the SDK allows slicing at level 3, so L3-only users would get false "no flow" answers until L4 ships.
• More hand-derived DDG fixtures. These only cover the shapes someone chose to write.

Additional context

• Found by the whole-branch review of PR Go L3 intraprocedural dataflow, app-outermost ids and L2 library calls #16.
• Needs a spec decision before code.
• Consolidates Add the go/ssa def-use differential check from the L3 spec #23 into this issue.