pool: walk_special_pool abandons a region on one bad page header

[glslang]

From claude-review on #80. Regression introduced by #80.

Special pool is page-granular — each page is independent — but when decode_pool_header fails for one page, walk_special_pool breaks instead of continue-ing, abandoning every later page in the region.

Worse, unlike every other rejection path in the file it pushes no diagnostic and does not clear snapshot.complete. So snapshot_report reports complete: true after silently skipping most of a region — defeating the exact purpose that flag was added for in this same PR — and because SnapshotCache only caches complete snapshots, the truncated result is the one persisted and re-served.

Fix: continue rather than break, push a diagnostic naming the page, and clear complete, matching walk_lfh and walk_vs.

[glslang]

Fixed on main by ce8bce2, which never referenced the issue. Verified against the current code and pinned by a test in #102 — none of the three had one, which is why they were reopenable by accident:

• pool: SessionKey.target makes the layout cache grow without bound #84: the rule lived in the caller as a SessionKey { target: 0, .. } before the call. Writing the test found the cache still keyed on the whole session when called directly, so the narrowing moved into LayoutCache as a LayoutKey it derives itself.
• pool: chunk_at never reports neighbours for VS-backend chunks #85: needed a VS-shaped fixture, which is exactly why it was missed — every test built spans with PoolSpan::allocation, whose LFH geometry puts header_address and usable_address at the same address. The new one fails against the pre-fix comparison, checked by restoring it.
• pool: walk_special_pool abandons a region on one bad page header #86: the page-granular skip now has a test that a bad page costs that page only.

Closing here; #102 carries the tests.