Isolate deferred callback state from lambda creation

[CatarinaGamboa]

Creating a lambda currently applies its body's state transitions to captured objects. For example, Runnable later = () -> manager.addEdit(null); manager.undo(); passes even though the callback may never run. Check lambda bodies in an isolated context so their assignments, branch facts, and try transitions do not change the surrounding execution.

Forget invocation-time assumptions about mutable captures while preserving guards on effectively final primitive captures. Restore variable instances, shared refinements, paths, and enclosing try recorders even after a body diagnostic. The regressions cover local and field callbacks, nested lambdas, try/catch/finally, invalid bodies, primitive guards, and the anonymous-class reproducer already fixed by #326.

Callback invocation summaries remain unsupported: listener.run() does not apply effects to its captures. Receiver-call checking and lambda return boundaries are handled separately by #384 and #385.

Validation: mvn test -pl liquidjava-verifier -am (389 tests, no failures) before the final blank-local capture precision adjustment. Both focused fixtures were rerun on the final code: the passing fixture verifies, including blank locals assigned before capture, and all seven expected failing-fixture diagnostic titles and positions match.

Fixes #341.

[rcosta358]

LGTM. We should also update the "Verification Features" section in liquidjava-docs to explain this, as a follow up of #2.