gc: port the native stack-map scanner to ELF/Linux (CI coverage + small-hardware numbers)

[proggeramlug]

The native stack-map scanner on exp/stackmap-viability is Mach-O-only: loaded_stack_map_section() returns None off macOS (crates/perry-runtime/src/gc/roots/stack_maps.rs), so the statepoint backend cannot execute on Linux at all. This blocks two things established during the 2026-07-31/08-01 campaign (see docs/statepoint-gc-experiment.md on the branch):

1. CI coverage — every gate for the native-root modes runs only on developer Macs; CI is Linux x86-64 and can exercise none of it.
2. Small-hardware numbers — Apple silicon has no unprivileged instruction counter, so all quiet-host figures are wall-clock. The Pi 5 perf stat discipline the repsel campaign uses (0.02% noise floor) needs the scanner to run on ELF. The shadow stack's cost profile is workload- and microarchitecture-dependent (measured 0.1% on numeric loops vs +26.7% instructions on activation-heavy code), so the M1 tie does not automatically transfer to narrow cores.

Design notes from the branch:

• Section discovery: ELF gives it away cheaper than Mach-O — reference __start___llvm_stackmaps / __stop___llvm_stackmaps linker-provided symbols instead of walking load commands. The v3 parser and the concatenated-sub-map walk are platform-independent already.
• Frame chain: generated functions already carry "frame-pointer"="non-leaf" in native-root modes. The Rust runtime side needs -Cforce-frame-pointers=yes on Linux (default on aarch64-apple only). x86-64 additionally changes the chain layout ([rbp] pair, DWARF regs 6/7 vs 29/31) and the SP = FP + 16 − stack_size reconstruction used for SP-relative statepoint spills must be re-derived for the x86-64 frame layout — do not port the constant.
• Walker: match_records and the verify mode (PERRY_STACKMAP_WALKER=verify, both walkers must visit identical slot sets) port as-is and are the acceptance gate: 8 gc-ratchet probes × forced evacuation × verify-walker, byte-matched to the pinned Node oracle, on Linux aarch64 (Pi) and x86-64 (CI).

Non-goal: changing any default. The scanner stays research-mode; this issue is about making the existing gates executable on the platforms Perry actually ships to.

[proggeramlug]

Implementation landed on the branch (e094fb026): ELF section discovery via /proc/self/exe section headers + dl_iterate_phdr load bias (no weak symbols, no -rdynamic), unwinder widened to Linux, aarch64-linux fast x29 chain with pthread_getattr_np stack bounds (fail-closed to the unwinder on any anomaly), x86-64 unwinder-only by design. cargo check clean natively and for x86_64-unknown-linux-gnu; aarch64-linux cross-check blocked locally by the psm dependency's build script (needs a cross C toolchain). Remaining for this issue: run the 8-probe forced-evacuation + verify-walker matrix on a Linux host, with -Cforce-frame-pointers=yes on the Rust side for the fast chain.

[proggeramlug]

x86-64 Linux runtime verification: 8/8 GREEN. Cross-built from macOS (perry --target linux --no-link for the probe objects, cargo zigbuild for the static archives with -Cforce-frame-pointers=yes, zig cc -target x86_64-linux-gnu ... -lunwind for the link), shipped as static binaries to an idle Ubuntu x86-64 host, and run: all 8 gc-ratchet probes pass under PERRY_GC_FORCE_EVACUATE=1 PERRY_GC_VERIFY_EVACUATION=1 in statepoint mode, byte-matched to the pinned oracles — first execution of the ELF section discovery (/proc/self/exe shdrs + dl_iterate_phdr bias), the Linux unwinder path, and statepoint relocation outside macOS. x86-64 runs unwinder-only by design (fast chain is aarch64). Remaining for this issue: the aarch64-Linux fast-chain verification (needs an arm Linux host) and wiring the matrix into CI.

[proggeramlug]

aarch64-Linux verification complete on the Pi 5 — 8/8 after one caught-by-design defect — #7173's runtime verification is now done on both architectures.

The verify-walker mode did exactly what it was built for: fast walk and unwinder disagreed by 80 bytes on one slot, exposing that SP = FP + 16 − stack_size is the Darwin AArch64 frame layout — aarch64-Linux places the [x29, x30] pair at the bottom of the frame. Fixed at 5bfaf05d6: SP-relative locations disqualify the fast chain off-Darwin (the always-correct unwinder serves) until the Linux constant is derived. With the fix, the Pi's forced-evacuation matrix is 8/8 byte-matched.

Also from the Pi (load ≤0.1, 9 interleaved reps): the first small-hardware timing — shadow 469.2 ms vs statepoints 538.2 ms geo-mean (+14.7%); the M1 parity does not transfer to narrow cores (part unwinder-only walking pending the Linux fast-chain constant, part genuine small-core cost). Any default-flip conversation now requires a Pi-class performance gate alongside the M1 matrix.

Two foot-guns recorded: unrecognized --target values silently compile for host (linux-arm64 → Mach-O; correct spelling linux-aarch64), and macOS↔Linux rsync with -q can fail silently (verify file counts).

Remaining for this issue: derive the aarch64-Linux frame constant to re-enable the fast chain there, and wire the cross-recipe (perry --no-link + zigbuild + zig cc -lunwind) into CI.

[proggeramlug]

The 'derive the aarch64-Linux frame constant' item resolves to a proven negative. Disassembled generated prologues in the shipped Pi binaries: a stack_size=128 function sets x29 = sp + 0x30; a stack_size=192 function sets x29 = sp + 0x60 — the FP↔SP offset varies per function with the callee-save area laid out below the [x29, x30] pair. No (FP, stack_size) formula can recover SP on aarch64-Linux; Darwin's pair-at-frame-top layout is what made the fast-chain constant possible there. The 5bfaf05d6 disqualification is therefore the permanent sound design for Linux, not a stopgap. The remaining routes to a Linux fast chain, both out-of-band: (a) persuade LLVM to emit FP-relative statepoint spills on ELF targets (upstream, same bucket as the empty-live-record item on #7174), or (b) Perry-emitted per-function FP-offset side metadata — the compact-section machinery, with its documented soundness constraints. The unwinder path is the correct Linux answer today, and the Pi timing (+14.7% vs shadow) is its honest cost. This issue's remaining scope is now exactly one item: CI wiring for the cross-recipe.