UB triggered on br in flatten-cfg

https://compiler-explorer.com/z/5zeMMz6Y6
https://alive2.llvm.org/ce/z/zaEeD6

Input:

```llvm
declare void @use()

define void @src(i32 %a, i32 %b) {
entry:
%cond1 = icmp sgt i32 %a, 0
br i1 %cond1, label %then, label %cond2.bb

cond2.bb:
%add = add nsw i32 %b, 1
%cond2 = icmp sgt i32 %add, 0
br i1 %cond2, label %then, label %end

then:
call void @use()
br label %end

end:
ret void
}
```

Optimize with `opt -passes=flatten-cfg`:

```llvm
declare void @use()

define void @src(i32 %a, i32 %b) {
entry:
%cond1 = icmp sgt i32 %a, 0
%add = add nsw i32 %b, 1
%cond2 = icmp sgt i32 %add, 0
%0 = or i1 %cond1, %cond2
br i1 %0, label %then, label %end

then:
call void @use()
br label %end

end:
ret void
}
```

The UB of `br` on a poison generated by `add nsw` is conditional in `src` and always executed in `dst`.

Start with the flatten-cfg pass invoked by opt -passes=flatten-cfg and reproduce the supplied LLVM IR in Compiler Explorer or opt. Compare the source and transformed IR with Alive2, then verify that the transformation preserves the conditional nature of the poison-triggering branch and its defined behavior.

Written by the indexing model from the issue text.