Test: cover script-scope pre-decrement and mixed ++/-- runs (#23840 follow-on)

[PurHur]

Gap

#23840 made every script-scope ++/-- a no-op. The cases that landed with its fix gate two
shapes:

existing case	covers
g08_incdec_post_dec	$n--
g08_toplevel_incdec_echo	$a++, and ++ inside a script-scope loop

Neither covers pre-decrement (--$n), nor a run that mixes both forms on one variable. Both
were equally broken while #23840 was live, and nothing exercises them today.

Added

--$n;                  // pre-decrement at script scope
$n++; $n++; $n--;      // mixed run on one variable
$z--; $z--; $z--;      // crossing zero — the sign flip
--$p;  $q--;           // both forms storing the same value

Kept top-level on purpose. The regression only ever appeared at script scope, because every
pre-existing ++/-- differential case declares its variables inside a function — that gap is what
let it ship.

Verified on master f98ba3500, both backends

• VM — run directly against bin/vm.php: matches Zend (4 / 2 / 3 / -2 / 9 9)
• AOT — ok g09_toplevel_predec_mixed.php in script/differential-sweep.sh --aot

I checked VM by hand rather than reading it off the sweep. The sweep run that covered AOT had
already globbed its case list before this file existed, so its VM section does not list it — and
inferring "passed" from "absent" is exactly the mistake that let #23840 through in the first place
(correction on #23781). Same trap, caught this time.

Sweep health on that commit, for reference

VM : 58/58 match Zend, exit 0
AOT: 34/55 match, 4 skipped, exit 21 — zero newly failing vs baseline

Test only, no lib/ changes.