Backend (underscore) var shadowing across substates is still silently accepted: the child's default is discarded and writes go to the parent

[masenf]

Describe the bug

#7077's _check_overridden_inherited_vars rejects a substate that redeclares an inherited base var, but it skips _-prefixed names (reflex/state.py:1335), so backend vars are not covered:

class P(rx.State):
    _priv: int = 1

class C(P):
    _priv: str = "x"      # accepted on 0.9.11.post1 and 0.9.12a1

C.backend_vars["_priv"] is the parent's, and in a real state tree the child's default is discarded and writes to c._priv land on the parent, exactly the silent shadowing #7077 set out to stop. #7206 (the mixin route, #7190) extends the same guard and inherits the same gap. news/7077.breaking.md reads as if all inherited vars are covered.

To Reproduce

The two classes above; C.backend_vars["_priv"], then in an app read and write _priv on the child and inspect the parent. Script: router_vars/verification/scripts/v_backend_shadow_tree.py.

Expected behavior

Extend the check to inherited_backend_vars (restricted to them, so framework-internal underscore attributes are unaffected), or narrow the #7077 changelog note to base vars.

Specifics

• Reflex 0.9.12a1 (also 0.9.12a2); pre-existing, identical on 0.9.11.post1
• Python 3.11.15

Additional context

0.9.12a1 pre-release QA, FINDING-006, confirmed by an adversarial verifier (LOW). Related: #7074, #7077, #7190, #7206. Evidence: router_vars/ and FINDINGS.md.

[linear-code]

ENG-12659