The machinery introduced in #40416 for finding dead code in bpf programs has a few remaining sharp edges.

• The reachability analysis result (2 bitmaps, live and jumps) is currently put into Blocks. The result should probably go into a separate object so Reachability() doesn't need to concern itself with checking whether analysis has already run. LiveInstructions() should also be implemented on this new structure. This way, things are nicely layered and concerns are separated.
• Tail call analysis merged in Avoid verifying tail call programs for disabled features  #41421 could use a clonable iterator that can backtrack from the current position without having to perform direct accesses to the underlying Instructions using offsets. Make it safe and fast.

Spinoffs:

• bpf/analyze: support branches on variables of any size #41874
• Allow callers to create VariableSpecs ebpf#1868