[NinoFloris]

This is a zero-diff PR.

CSE rewrites a use's conservative value number to its reaching definition's, while nodes that carried the old number keep it. InsertUseIntoSsa already works around this for one fact, carrying checked-bound membership across the rewrite by hand. #136840 hit the same issue as null checks that survived a copy of the receiver. It recovered the identity by walking SSA copies at the lookup. Exact-type facts on a copied receiver and range facts on a captured bound lose track through CSE the same way.

This PR begins to record the rewrite as an equivalence in the value number store: in a small union-find over rewritten numbers, empty for methods where no use changed, with the reaching definition's number as the 'representative' VN. Nothing consults it yet and the checked-bound transfer stays as it is. A follow-up keys assertions by the representative.

It is recorded exactly when CSE merges two loads into one. A reloaded heap field gets a fresh conservative number because nothing has decided yet that the loads can be one (fgValueNumberTree, field loads). Only the one rewrite site (InsertUseIntoSsa) makes them equal, so facts never cross between loads that stayed separate.

[azure-pipelines]

Azure Pipelines:
Successfully started running 5 pipeline(s).
10 pipeline(s) were filtered out due to trigger conditions.
There may be pipelines that require an authorized user to comment /azp run to run.

[dotnet-policy-service]

Tagging subscribers to this area: @JulieLeeMSFT, @jakobbotsch
See info in area-owners.md if you want to be subscribed.