Reserve declared names against generated tN/TN identifiers (#8)

[petlenz]

Closes #8.

User symbols named t0/t1/T0/T1 collided with generated CSE temporaries and template parameters, producing uncompilable emitted code (parameter redeclaration / template-parameter shadowing — reproduced on the issue).

• CodeGenContext gains reserve_name(); fresh_name() skips reserved candidates. Reservations survive reset() (they describe the surrounding function's identifiers, like the temp counter reset already preserves) and clear on full_reset().
• New detail::emission_reserved_names(RecipeView) — all symbol names (incl. _old rows), output names + _out variants, tangent names + _out — seeded in CodeEmitPass::run; the coupled-Newton reserved_ids block now reuses the same helper. render_compute_function picks template-parameter names from the same collision check, single-sourced between the template<...> list and the signature.
• NumSimMaterialTarget builds its own contexts outside the pass pipeline (same bug class) — seeded there too.

Skip-on-collision-only: with no collision the emitted text is byte-identical — all 321 pre-existing tests pass unmodified (many pin t0/t1/T0), plus an explicit GeneratedNamingUnchangedWithoutCollision guard. Real regression gate: recipe ReservedNamesCheck (inputs t0, t1, tensor input T0, tensor output T1) is generated, COMPILED, and numerically checked in the compile-check driver — emits template <typename T2, typename T3> with temps starting at t2.

Rebased onto current main. gcc-14 Debug (-Werror): ctest 327/327.

Note: when PR #124 merges, its newton_reserved_ids helper and this PR's emission_reserved_names cover adjacent concerns — trivial merge either order; unifying them is a two-line follow-up.