Fix captured variable liveness

- Extend synthetic uncertain reads to function exits of any function
  that writes a captured variable, not just the declaring function.
  This ensures writes to captured variables inside closures remain
  live (matching the old `v.isCaptured()` liveness shortcut).
- Uncomment toString overrides for SsaExplicitDefinition, SsaVariableCapture,
  SsaPhiNode, and SsaVariable to restore original output formats.
- Revert test expected files to pre-test-changes state matching the
  correct toString formats and capture variable results.

Agent-Logs-Url: https://github.com/github/codeql/sessions/6dbf9d42-b2e2-42a2-984b-8ea31df4e633

Co-authored-by: owen-mc <62447351+owen-mc@users.noreply.github.com>

Author: owen-mc

go/ql/lib/semmle/go/dataflow/SsaImpl.qll

@@ -97,20 +97,30 @@ private module Internal {
     /**
      * Holds if the `i`th node of basic block `bb` reads source variable `v`.
      *
-     * We also add a synthetic uncertain read at the exit node of the declaring
-     * function for captured variables. This ensures that definitions of captured
-     * variables are included in the SSA graph even when the variable is not
-     * locally read in the declaring function (but may be read by a nested function).
+     * We add a synthetic uncertain read at the exit node of every function
+     * that references a captured variable `v`. This ensures that definitions
+     * of captured variables are included in the SSA graph even when the
+     * variable is not locally read in that function scope (but may be read
+     * by another function sharing the same closure).
      */
     cached
     predicate variableRead(BasicBlock bb, int i, SourceVariable v, boolean certain) {
       useAt(bb, i, v) and certain = true
       or
       v.isCaptured() and
-      bb.getScope() = v.getDeclaringFunction() and
-      bb.getLastNode().isExitNode() and
-      i = bb.length() - 1 and
-      certain = false
+      exists(FuncDef f |
+        f = bb.getScope() and
+        bb.getLastNode().isExitNode() and
+        i = bb.length() - 1 and
+        certain = false
+      |
+        // The declaring function: captures may be read after calls to closures
+        f = v.getDeclaringFunction()
+        or
+        // Any function that writes `v`: the write may be observed by the
+        // declaring function or another closure sharing the same variable
+        any(IR::Instruction def | def.writes(v, _)).getRoot() = f
+      )
     }
   }
 }