Fix #336: gate pow-of-pow exponent composition on the real domain

[petlenz]

Closes #336. Closes #463.

(x^a)^b = x^(a·b) holds for every real x only when a and b are integers; otherwise it needs x ≥ 0. Three folds composed exponents with no such check, so they either changed the value or invented one where the expression is undefined:

Expression (x = −4)	Before	Now	True
pow(pow(x,2), 1/2)	folds to x, −4	unfolded, 4	4 (|x|)
sqrt(pow(x,2)) (same expression, other spelling)	4	4	4
pow(pow(x,1/2), 2)	folds to x, −4	unfolded, NaN	undefined
pow(pow(x,3), 1/3)	folds to x, −4	unfolded, NaN	undefined
pow(pow(x,1/2)*y, 2)	x*pow(y,2), −16	unfolded, NaN	undefined
pow(sqrt(x), 2)	folds to x, −4	unfolded, NaN	undefined
pow(pow(x,y), 2), y = 1/2 at eval	folds, −4	unfolded, 4	4

Condition implemented

Fold when either:

1. the base is provably nonnegative — a nonnegative numeric constant, or (scalar) is_nonnegative/is_positive; or
2. both exponents are provably integer — a numeric integer, or (scalar) a symbol carrying integer{}.

Why this shape:

• Both-integer is sound for any real x — integer powers compose, negatives included (pow(pow(y,-2),-2) → pow(y,4) still folds).
• a·b being an integer is NOT sufficient, so the fold cannot be gated on the composite exponent: a = 2, b = 1/2 gives a·b = 1 and is exactly the reported bug.
• a odd with b integral adds nothing — already a subset of both-integer. Its neighbour a = 3, b = 1/3 is unsound, not an exemption.
• Symbolic exponents are not provably integer unless assumed, so they no longer compose on an unknown-sign base (pow(sqrt(x), n) and symbolic-exponent pow-of-pow fold unsoundly for negative bases (existing tests pin the current behavior) #463). is_integer is queryable and lifts the gate: with m, n assumed integer, pow(pow(x,m),n) folds and evaluates 4096 on x = −4.
• pow(sqrt(x), n): sqrt(x) is real only for x ≥ 0, so the radicand must be provably nonnegative (pow(sqrt(x), n) and symbolic-exponent pow-of-pow fold unsoundly for negative bases (existing tests pin the current behavior) #463).

Sites gated

• detail::pow_pow_dispatch (generic — used by t2s) and scalar simplifier::pow_pow, template and negative_type overloads.
• detail::mul_pow_dispatch and scalar simplifier::mul_pow: extracting pow(z,c) out of pow(x*pow(z,c), n) composes c with n, so each nested factor gets the same check.
• pow_base::dispatch(scalar_sqrt).
• Tensor pow needs no gate: tensor_std.h rejects non-integer constant exponents at construction (tensor_pow broken beyond positive-int/rank-2: eval(pow(X,-1)) returns X (no inversion), pow(X,0.5) evaluates to identity, diff(pow(X,-n)) silently 0, pow(rank-4, 0) yields rank-2 identity #350), so composition stays in the integer regime.
• t2s limitation: the t2s path has neither a positivity nor an integer query, so it uses the numeric half of both conditions only. A t2s base known positive, or a wrapped scalar exponent assumed integer, misses the fold. Precision loss, not unsoundness.

Existing tests updated

Each old assertion pinned a fold that is wrong for a negative base; each new one states the domain condition instead. All verified numerically through the evaluator.

Location	Old	New	Why the new one is correct
ScalarExpressionTest.h:169	pow(pow(x,_2),-y) → pow(x,-2*y)	→ pow(pow(x,2),-y); added pd nonneg → pow(pd,-2*y)	y may be 1/2: (x²)^(−1/2) is 1/|x| = 0.25 at x = −4, while x^(−1) = −0.25
:170	pow(pow(x,_3),-y) → pow(x,-3*y)	→ unfolded	same, odd inner exponent does not help: (x³)^(−1/3) is NaN
:171	pow(pow(x,_2),-x) → pow(x,-2*x)	→ unfolded	exponent -x is symbolic, may be fractional
:172	pow(pow(x,y),-z) → pow(x,-y*z)	→ unfolded; added pow(pow(pd,y),-z) → pow(pd,-y*z)	both exponents symbolic; a nonnegative base lifts it
:173	pow(pow(x,y),-x) → pow(x,-x*y)	→ unfolded	same
:367	pow(pow(x,y),z) → pow(x,y*z)	→ unfolded; added pb nonneg folded, and m,n assumed integer → pow(x,m*n)	y = 2, z = 1/2 reproduces the #336 bug; the two added cases show both escapes
:368	pow(pow(x,y),_2) → pow(x,2*y)	→ unfolded	y = 1/2 gives (x^(1/2))², NaN for x < 0, while x^1 = −4
:369	pow(pow(x,_2),y) → pow(x,2*y)	→ unfolded	y = 1/2 is the reported bug exactly
:388	pow(x*pow(y,z),_2) → pow(x,2)*pow(y,2*z)	→ unfolded; added nonneg-base companion	extraction composes z with 2, same condition
:805	pow(sqrt(x),_2) → x	→ pow(sqrt(x),2); added p nonneg → p	sqrt(−4) is NaN, so the left side is undefined where x is −4
:807	pow(sqrt(x),_3) → pow(x,3/2)	→ unfolded; added p nonneg → pow(p,3/2)	same
TensorToScalarExpressionTest.h:267	pow(pow(trX,x),_2) → pow(tr(X),2*x)	→ pow(pow(tr(X),x),2)	x may be 1/2 and tr(X) may be negative; the t2s path cannot query either assumption

Unchanged and still folding: every both-integer case (:365-366, :372-374, :161-163, :167, t2s :264-266), since integer exponents compose for any real base.

New tests

ScalarEval.PowOfPowKeepsRealDomain, ScalarEval.PowOfMulKeepsRealDomain, ScalarEval.PowOfSqrtKeepsRealDomain, ScalarEval.PowOfPowSymbolicExponentsKeepRealDomain, T2sEval.PowOfPowKeepsRealDomain, AssumptionFixture.PowOfPowFoldsForNonnegativeBase, AssumptionFixture.PowOfPowKeepsFractionalExponentsForUnknownSign — numeric via the evaluators, covering negative base × {even, odd} inner × {integral, fractional} outer, symbolic exponents that are fractional at evaluation time, both nonnegative-base and assumed-integer escapes, and both spellings agreeing.

Negative control (production sources restored from main, tests kept): every new test and all four updated test bodies fail. PowOfPowFoldsForNonnegativeBase passes both ways by design — it pins folding that must not regress.

Full suite 2412/2412 (gcc-14 Debug), clang-tidy clean with --warnings-as-errors='*' on the changed .cpp, clang-format clean.