proxy locs for joining heapenvs; inline unfolds

- proxy (l >> l') heapenv binding denotes that location l was joined
  with another location, and l' serves as the proxy for both in
  subsequent heap sat checks
- refs to proxied locs should still allow invariant updates,
  but haven't added this yet
- whiles are a bit tricky, but simpler when not hoisting unfold out
  of loop guards
- so now inferred unfolds are all inserted inlined