reject location aliased to two object types in reflection verify

[fr-manvi]

The reflection SafeBuffer verifier deduped verified tables by buffer position only:

• two differently typed fields aliased onto the same child offset let the second reference skip verification
• buf_loc_to_obj_idx then keeps a type those bytes were never checked against (last writer wins)
• SafeBuffer reads that offset under the wrong layout: a multi-GB out of bounds slice range, or a &str built over unchecked bytes (invalid UTF-8) straight from the safe API

record_obj_idx now rejects any location reached as two object types. Forward only uoffsets keep the root and legitimate same type sharing untouched. Added a regression test that aliases enemy (Monster) and testempty (Stat) onto one table and asserts the verifier rejects it.