Fix a bug with the closed env, and add a test

  It was possible to exploit shadowing to get a name into the closed environment
that wasn't actually closed.  The change here is that `partitionClosed` now
returns a completely new closed environment with any shadowed names removed, and
that environment is used when checking the declarations it describes, instead.