polyself: handle a second form change that happens during a polymorph - #1681

The hero's form is installed by set_uasmon() (polyself.c:815, called
from polymon()), but the hero's LS_MONSTER light source is created in
polyself()'s made_change: block (polyself.c:720-730), which only runs
after polymon() has returned. Between those two points the hero is a
light-emitting monster with no light source, and polymon() does a lot of
work in there that can revert the form: break_armor(), drop_weapon(),
expels(), spoteffects(), retouch_equipment(2). Any of them can take
u.mh below 1, at which point losehp() (hack.c:4267) calls rehumanize(),
which deletes on the basis of the current form without checking that a
source exists (polyself.c:1393):

    del_light_source: not found type=2, id=0x...
    Program in disorder!  (Saving and reloading may fix this problem.)
    Please report these messages to devteam@nethack.org.

The assumption that fails is that being in a light-emitting form implies
a light source exists. Two hand-placed workarounds for the same split
already exist -- the old_light = 0 at polyself.c:581 and the explicit
delete before slime_dialogue()'s polymon() call at timeout.c:488.

Three consequences follow from the split, of which the impossible() is
only the first. If the hero was already glowing, made_change: deletes a
second time after a nested rehumanize() already did. And the roughly
twenty direct polymon() callers outside polyself.c never run
made_change: at all, so a fire vortex who catches lycanthropy
(were.c:209) keeps its light source forever: were.c has no light
handling, and a werewolf does not emits_light(), so rehumanize() will
not delete it later either.

Move the transition into a helper called from every place that installs
a form, so the two can never be out of step: polymon() and polyman()
(which covers newman() and rehumanize()). The made_change: block and its
two workarounds are then redundant and removed, and slimed_to_death()'s
comment is updated to say that polymon() now does the light bookkeeping.
emits_light() (mondata.h:178) returns only 0 or 1, so the == 1 ? ++
normalisation to 2 is the only radius arithmetic and it is preserved
verbatim.

The invariant this establishes, true at every observable point: once
gy.youmonst.data names a light-emitting form its LS_MONSTER source
already exists, and once a non-emitting form is installed the old source
is already gone. The direct polymon() callers get correct handling for
free.

Behaviour change, deliberate: the light now appears at set_uasmon()
rather than after polymon() returns, so anything inside polymon() that
consults the light map sees the new form's light instead of the old
state.

Recorded reproducers, analysis and verification:
https://github.com/davidbau/nethack-bugreport/tree/main/bugs/07-polyself-light-delete-before-create

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
(cherry picked from commit 9a5fcf7)

break_armor() caches the hero's form at entry (polyself.c:1160) and then
asks that cached uptr what to strip: breakarm(uptr), sliparm(uptr),
nohands(uptr), verysmall(uptr), slithy(uptr), uptr->mlet == S_CENTAUR,
is_whirly(uptr), has_head(uptr).

Its own gloves block calls drop_weapon(0) at polyself.c:1254. If the
wielded item is an artifact whose #invoked levitation is holding the hero
up, releasing it ends that levitation -- finesse_ahriman() says so --
so freeinv() reaches float_down() and the hero lands on whatever is
below. If that is lava and the water walking boots are still worn (they
come off in the next sub-block), lava_effects() takes its survivable
branch at trap.c:6811, losehp() drives u.mh below 1, and rehumanize()
runs. The hero is human again, inside break_armor().

break_armor() then resumes with uptr still pointing at the old form and
strips a human's shield by a newt's nohands, then a human's water
walking boots by a newt's verysmall. With the boots gone the next
lava_effects() no longer qualifies for the losehp() branch and goes
straight to done(BURNING).

The hero does not die of lava damage -- a level 30 Valkyrie absorbs
d(6,6) indefinitely. They die because the game took their water walking
boots off while they were standing in lava.

uptr is stale but valid: gy.youmonst.data always points into the static
mons[] table, so this is a logic error, not memory unsafety.

Stop when the form being worked on is no longer the hero's form, at
three sub-block boundaries: after the gloves block, before the boots
block, and before the eyewear block. Checking at boundaries rather than
mid-block matters, because each sub-block pairs an _off() with a
dropp() and bailing between them would leave an item half-removed.

The invariant this restores: break_armor() only ever strips gear the
hero's current form cannot wear.

Recorded reproducer, analysis and verification:
https://github.com/davidbau/nethack-bugreport/tree/main/bugs/08-break-armor-stale-form

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
(cherry picked from commit e386569)