Fix L_Z embedded mangled name in primary expressions

When a template non-type parameter uses a pointer to a function as its
value, the Itanium ABI encodes it as L <mangled-name> E inside the
template argument.  DemanglePrimaryExpression() handled this case via
a _Z prefix check, but called DemangleSymbol with m_topLevel=false and
without clearing the outer template substitution table.

This caused T_ / T0_ / ... references inside the embedded symbol's
parameter list to resolve against the outer symbol's template params,
not the inner symbol's, leading to a DemangleException and a complete
demangling failure for these symbols.

Fix: save/clear m_templateSubstitute and set m_topLevel=true before
recursing into DemangleSymbol for the embedded name, then restore
both afterwards.  This mirrors the same pattern used by DemangleLocalName.

Also use GetTypeAndName() instead of manually concatenating
GetStringBeforeName() + name + GetStringAfterName() to ensure
proper spacing between return type and function name.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: plafosse

demangler/gnu3/demangle_gnu3.cpp

@@ -960,13 +960,18 @@ string DemangleGNU3::DemanglePrimaryExpression()
 	if (m_reader.PeekString(2) == "_Z")
 	{
 		m_reader.Consume(2);
+		// The embedded _Z... is an independent mangled name with its own
+		// template scope.  Save and clear the template substitution table
+		// so inner T_ / T0_ etc. resolve within this symbol, not the outer
+		// one.  Set m_topLevel = true so template args get pushed properly.
+		auto savedTemplateSubstitute = m_templateSubstitute;
+		m_templateSubstitute.clear();
 		oldTopLevel = m_topLevel;
-		m_topLevel = false;
+		m_topLevel = true;
 		DemangledTypeNode t = DemangleSymbol(tmpList);
 		m_topLevel = oldTopLevel;
-		out += t.GetStringBeforeName();
-		out += tmpList.GetString();
-		out += t.GetStringAfterName();
+		m_templateSubstitute = std::move(savedTemplateSubstitute);
+		out += t.GetTypeAndName(tmpList);
 		dedent()
 		return out;
 	}