fix(rewrite): freeze operands against any later side effect

[RonnyPfannschmidt]

Fixes #14820. Stacked on #14817 → #14816 → #14815 → #14814 → #14447 → #14921 → #14813; its diff includes theirs.

visit_operand() froze a name only when a walrus operator in a later operand targeted it. A call can rebind just as well, through global or nonlocal, and then the name — still unhoisted, still read when the enclosing expression is assembled — sees the new binding:

count = 0

def bump():
    global count
    count = 99
    return 0

def test_left_operand_is_read_too_late():
    assert count == bump()   # Python compares 0 == 0 and passes

There is no way to tell from the assert which names a call might rebind, so _walrus_targets() becomes _can_rebind(): freeze a name whenever anything that follows it can execute code at all (Call, Await, NamedExpr).

That sounds expensive and is not. An operand that was already hoisted needs no freeze, so the common shapes are byte-identical:

assert len(items) == expected     # unchanged, left operand is already a temporary
assert value == compute()         # one extra assignment

visit_BoolOp used the same pre-scan and is generalized with it, which leaves one rule in one place instead of two spellings of half of it.

Lands the order-name-rebound-by-call cases of the coverage matrix in #14813, as passing tests (+3).

Found by sweeping the rewriter for evaluation-order divergences after the walrus work — this is the same defect class as #14445, reached by a different trigger.