General Solution For Cex Reconstruction

Right now we have some fairly ad hoc solutions to reconstruct proper Cexs when we have lost information due to simplification.

A more general approach that would work for all cases could look like this:

1. Gather all variables mentioned in the starting state (e.g. calldata, storage, context etc...)
2. During simplification keep track of which rewrites have been applied (e.g. if we rewrote `a == a || b == 6`into `True`, we lost information that `b == 6`).
3. If we get `Sat`, declare all variables from step 1 that are not present in the current query, assert concrete values for any variables mentioned in the cex, assert all facts that were simplified away in step 2.
4. Call `check-sat`, now we should have a full and valid cex for that branch

No files, tests, or entry points are named. Start by locating the simplification logic and existing counterexample reconstruction, then trace how rewritten-away facts are handled. Done means the proposed process reconstructs a full, valid counterexample for every affected branch.

Written by the indexing model from the issue text.