Harden the in-place cached-array write scan (positional out, loop fixed point, walrus, more views, tools/)

[MaxGhenis]

Follow-up to #9739. Its code-health scan (policyengine_us/tests/code_health/test_no_in_place_writes_to_cached_arrays.py) misses these forms. The independent review of #9739 (round 2) executed each one against a cached array: the write changed the cached value and the scan reported nothing. None appears in variables/, reforms/ or tools/ today, so these are latent gaps, not live bugs.

1. Positional out. min_(x, 0, x), np.add(x, 1, x), x.clip(2, None, x), np.negative(x, x). Fix: for NumPy ufuncs and clip, treat positional arguments past the input count as outputs.

2. No fixed point for loops and try.

   • An alias chain that needs three loop passes before the write.
   • An except block reached after a raise partway through the body.
   • A finally that runs after return x inside the try.

   Fix: repeat the loop walk until the tracked set stops growing. Start handlers and finally from the union of the states after each body statement. The review checked that a variant doing this finds nothing in the 226 production files with loops or try.

3. Other forms.

   • Walrus bindings.
   • Nested defs writing a captured array.
   • These views: x[:, None], x[...], np.ravel, np.reshape, np.atleast_1d, np.ascontiguousarray, np.array(x, copy=False), same-dtype astype(copy=False), x.real[:].
   • Keyword-style calls: tax_unit("x", period=period) and add(..., variables=[...]).
   • Match capture patterns, annotated subscript assignment, and NumPy imported under another alias.

4. Scope. Add policyengine_us/tools/ to the scanned roots. Entity-taking helpers live there (state_eitc_helpers.py, general.py); it is clean today.

Each fix should add the executed case to the scan's self-tests, and the scan should still report nothing on main.