GNU3 demangler: fix substitution table for unscoped template names and sr intermediate qualifiers

Two missing substitution table entries caused out-of-range access (SG_=17)
when decoding symbols like std::swap<T> with enable_if/enable_if constraints:

1. DemangleName case 'S': after processing template args for an unscoped name
   (e.g. St 4swap I...E), the encoder pushes BOTH the prefix (std::swap) AND
   the full instantiation (std::swap<T>) to the substitution table.  We were
   only pushing the prefix.  Fixed by adding PushType(type) after template
   args are appended.

2. DemangleExpression sr else branch: when processing a multi-level sr scope
   without the N prefix (e.g. sr St 6__and_ I...E ...), intermediate template
   qualifiers must be pushed to the substitution table.  Previously the while
   loop appended to 'out' but never called PushType, unlike the N-prefix branch.
   Fixed by adding PushType(CreateUnknownType(...)) for intermediate qualifiers.

Reduces failures from 211 to 90 on the 178,883-symbol test corpus (99.95%).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: plafosse

demangler/gnu3/demangle_gnu3.cpp

@@ -1859,6 +1859,9 @@ string DemangleGNU3::DemangleExpression()
 					if (isdigit(m_reader.Peek()))
 					{
 						// Another source name follows — intermediate qualifier.
+						// Push to the substitution table, mirroring what the
+						// N-prefix sr branch does for each nested qualifier.
+						PushType(CreateUnknownType(out + segName + GetTemplateString(args)));
 						out += segName + GetTemplateString(args) + "::";
 					}
 					else
@@ -2243,6 +2246,11 @@ DemangledTypeNode DemangleGNU3::DemangleName()
 			DemangleTemplateArgs(args);
 			ExtendTypeName(type, GetTemplateString(args));
 			type.SetHasTemplateArguments(true);
+			// Push the template instantiation (e.g. std::swap<T>) so that the
+			// substitution table matches what the encoder built.  The encoder adds
+			// both the unscoped-template-name (prefix, already pushed above) and
+			// the full template-id (instantiation).
+			PushType(type);
 		}
 		break;
 	case 'N': //<nested-name>