feat(aot): recover unwind ranges and load facts without section headers

[yabanana]

What

Recover unwind ranges, dynamic symbols and load facts from program headers only, so a linked x86-64 ELF without a section table recovers the same function candidates and imports as the same image with sections.

• unwind_index.py reads PT_GNU_EH_FRAME and the eh_frame stream through PT_LOAD mappings. Each indexed FDE must match its search-table key and lie in one executable file-backed segment. Unsorted or duplicate tables, extended records, foreign return columns, unsupported encodings and out-of-image pointers reject. A missing index, unindexed FDEs, overlapping ranges, an unterminated stream and personality slots without a relocation become explicit obligations instead of guessed ranges.
• load_facts.py writes a dossier of entry, lifecycle, export and address-taken roots, direct calls, PLT/GOT import bindings with provenance, preconditions, dependencies and invalidation conditions. Indirect transfers, tail calls, interior calls and unclassified executable bytes stay obligations. An FDE is unwind evidence, not a function boundary or ABI.
• recover_image consumes the qualified ranges and the dynamic symbols; unwind obligations enter unknowns, so contract materialization still rejects them.
• dynamic.py counts symbols from DT_GNU_HASH (bounded chain walk, agreement with DT_HASH when both exist).

Tested

Latest integration checkpoint (12 October): aligned with main 2f4cc8983, including the new component technical-debt layout. The final combined stack with the separate C++ follow-up #4718 passed 588 compiler/relinker/runtime checks and 26 native integrations on Apple Silicon. Rebuilt cube AOT/reference still match all eight RGB frames after 600 flips each; controller and typed module-bundle acceptance pass. These are local results; hosted CI is running on the updated head. Full Linux/Windows builds still require maintainer dispatch.

Apple Silicon/macOS, merged with current main and with the native AOT examples enabled: 559 compiler/relinker/runtime checks passed, including 30 new load-fact cases and two GNU-hash cases (positive and negative fixtures for every rejection and obligation above, deterministic regeneration, binding changes). The integration test checks that a section table does not change recovery and that the recovered ranges reach contract materialization.

Locally, outside the repository: zstd 1.5.7 and yaml-cpp 0.9.0 linked as glibc x86-64 PIE with Zig 0.14.1, in four variants each (full, stripped, without section table, without the unwind index header). Without a section table the previous recovery rejected with missing dynamic symbol; now stripped and section-less variants give identical results (961 and 2110 ranges, 68 and 97 imports); without the index the recovery reports unwind-index-missing. Ranges match the relinker's EhFrameReader on both inputs; on eight corrupted variants this reader rejects or reports cases the relinker reader accepts silently (unsorted/duplicate table, out-of-executable range, unterminated stream). yaml-cpp exposed indirect personality slots, and the first hosted macOS run exposed the four-byte PT_GNU_EH_FRAME placeholder that ps5link writes at address 0; an index whose file offset is not the loaded offset of its address now reports unwind-index-not-loaded instead of being parsed. Both have regressions. Hosted CI pending; full Linux/Windows builds need maintainer dispatch. No conversion of these programs is claimed here.

Checklist

• Based on current main through the open AOT stack; checked for overlapping implementations
• One topic; follow-ups remain separate
• No added code comments, private notes, reports, images or binary fixtures
• Unsupported inputs reject; no weakened guards or silent fallback
• No new third-party runtime dependency
• Generic behavior, not specific to one input
• Depends on: test(aot): qualify modular TLS workers against a native C reference #4523, feat(aot): lower module TLS and guard joinable native guest threads #4522, feat(aot): execute qualified module lifecycle in dependency order #4521, feat(aot): compile closed module bundles with checked native bindings #4520, test(aot): run optimized controller and independent component consumers #4424, feat(aot): lower finite native dispatch and optimized integer operations #4423, feat(aot): retain incremental debug facts and scoped obligations #4422, feat(aot): run controller input and independent provider-transfer consumers #4397, feat(aot): qualify provider contracts and recover bounded debug facts #4396, feat(aot): derive guard sites from qualified image recipes #4156, feat(aot): run source-built graphics on native Apple ARM64 #3891, feat(aot): discuss native ARM64 compiler architecture and integration #1835
• Unblocks: none
• AI-assisted: yes

[yabanana]

Superseded by #5021, which now contains the consolidated native ARM64 AOT implementation and verified consumers. #1835 remains the architecture discussion. Closing this stacked PR to keep one implementation review; its branch and review history are retained. This is not a merge into main.