[CIR] Fix bitfield post-increment return value (#201723)
In \`emitScalarPrePostIncDec\`, the bitfield branch called
\`emitStoreThroughBitfieldLValue\` and returned its result directly,
bypassing the \`return e->isPrefix() ? value : input\` logic that
selects old vs new for post vs pre-increment. For post-increment on a
bitfield, this returned the new (incremented) value instead of the old
one, so \`if (s->nRefs++)\` always evaluated true even when \`nRefs\`
was zero on entry.
Fix by assigning the store result to \`value\` and falling through to
the existing prefix/postfix selector, mirroring the non-bitfield path.
Found via the SPEC CPU 2026 abc_r benchmark: \`Cnf_ManScanMapping_rec\`
uses \`if (pObj->nRefs++)\` on a 26-bit bitfield to detect
already-visited AIG nodes. With the bug, every call returned true
(already visited) immediately, producing an empty CNF mapping and a
spuriously satisfiable SAT problem (133 variables instead of 3018).
