Count a timeout retry's flips instead of forbidding them

[alanhc]

a_timed_out_goal_is_retried_at_double_the_timeout asserted that no goal
flips, but the fixture has provable goals, and whether one of them times out at
1 s and then proves at 2 s depends on the host. Fixes #28.

Change

prover-timeout.c has one assertion, typed_nocast_slow_assert, that no
prover discharges. RTE adds signed-overflow obligations for its cubes, and
those are provable. The test now requires that:

• at least one goal timed out at 1 s,
• at least one of those is still unproved after the retry, and
• typed_nocast_slow_assert is never among the flips. The match is exact,
  because the overflow obligations share its prefix
  (typed_nocast_slow_assert_rte_signed_overflow).

It does not assert that still_unproved and flipped add up to
timed_out_first_pass: timeout_retry_report derives still_unproved by
subtracting the flip count, so that equality holds by construction and says
nothing about WP.

The checks for the retry, the doubled timeout and the cache are unchanged. The
doc comment no longer says the flip set stays empty.

Testing

The goal name comes from running Frama-C 33.0 WP on the fixture directly
(-wp-rte -wp-model Typed+nocast -wp-timeout 1 -wp-fct slow), which reports
[Timeout] typed_nocast_slow_assert.

• Ubuntu 24.04 riscv64 in qemu-system-riscv64 (TCG), Frama-C 33.0, Alt-Ergo
  2.6.3. Before this change the test failed alone and in every full stdio run,
  with the same test body as on main. At 5b2c13a it passed 3 of 3 alone.
• macOS 26.6 (Apple Silicon), same Frama-C and Alt-Ergo: a4e4b95 passes alone,
  and cargo clippy --all-targets is clean.

The full gate was not rerun, because the change is limited to this one test.

---

Summary by cubic

Fixes the timeout retry test so it counts flips instead of forbidding them, resolving a host-dependent failure on riscv64. The test previously asserted no goal could flip; now it requires at least one timed-out goal to remain unproved and never lets typed_nocast_slow_assert itself flip. Retry, doubled timeout, and cache checks are unchanged. The timeout_retry_report doc comment now notes the live test can't force a flip on demand. Fixes #28.

^{Written for commit 2a14875. Summary will update on new commits.}

[jserv]

This comment now says a live flip can happen, but the doc comment on timeout_retry_report in src/mcp/server.rs still says "the live test only ever reaches this with an empty flip set". Update that sentence in this PR, or the two comments contradict each other.