Skip self-substitution in SubstituteInExpr

SubstituteInExpr directly sets mutations_[reference] = substitute
without checking reference == substitute, unlike registerMutation
which guards against this. With per-Fusion special vals, Fusion::copy
now maps zero_val_ through the cloner so that IterDomain extents and
zero_val_ share the same pointer. When concretizeEmptyExtents finds
an extent that IS zero_val_, SubstituteInExpr created a self-mapping
that tripped the two-hop assertion in maybeMutated.

Why this didn't happen before:

  Old code (main):
    zero_val_ was stored in a separate unique_ptr, popped from
    vals_up_. Fusion::copy didn't wire it up — B->zeroVal() lazily
    created a brand new Val, so ext != zero always held.

  New code (this branch):
    zero_val_ lives in vals_up_ like any other Val. Fusion::copy
    remaps it via ir_cloner.clone(), so B->zero_val_ IS the same
    cloned Val that IterDomain extents reference:

      Fusion A                         Fusion B (clone)
      ┌─────────────────┐             ┌──────────────────┐
      │ zero_val_ ─► 0x1111           │ zero_val_ ─► 0x2222
      │ id->extent() ─► 0x1111        │ id->extent() ─► 0x2222
      └─────────────────┘             └──────────────────┘
                            clone maps 0x1111 → 0x2222

    So ext == zero, and SubstituteInExpr(ext, zero) created:
      mutations_[0x2222] = 0x2222  (self-mapping)
    Then maybeMutated looked up 0x2222, found itself, treated
    it as a two-hop chain, and asserted.

Author: mdavis36

csrc/ir/utils.cpp

@@ -208,7 +208,9 @@ struct SubstituteInExpr : public OptOutMutator {
 
  private:
   explicit SubstituteInExpr(Val* reference, Val* substitute) {
-    mutations_[reference] = substitute;
+    if (reference != substitute) {
+      mutations_[reference] = substitute;
+    }
   }
 
  private: