gen-verilog-sim: test-block local bindings emitted as assignments without reg declarations

[gHashTag]

With assert lowering (#1885) in place, a sweep of tri-net's 26 icarus-lowerable ring specs shows 21 of them fail iverilog compile with one uniform signature: a test block that binds intermediate locals before asserting, e.g.

test sha256_abc_h0 {
    h = sha256_word(0x61626380, 0, ..., 0x18, 0);
    assert(h == 0xBA7816BF, "abc h0");
}

emits h = sha256_word(...); in the testbench initial block without ever declaring reg [31:0] h;:

t27c_icarus_tri_sha256.v:1622: error: Could not find variable ``h'' in ``TriSha256.sha256_abc_h0_test''

Same for tri_ledger (b0), tri_merkle (l0/l1), tri_a2a (w), tri_fec (p, surv), and 16 more. The call-into-assert pattern works (the compiler hoists _t27_call_tmp_* regs with declarations -- that is why the four tri_gft specs compile); only explicitly named test-block bindings are missed. Fixing the declaration hoisting for named test locals would unlock simulation for ~21 more tri-net ring specs (list in tri-net .github/workflows/gft-verilog-kat.yml comment).

Repro: t27c icarus-simulate <tri-net>/specs/tri_sha256.t27 (or tri_ledger / tri_merkle / tri_a2a / tri_fec ...).