Harden rewrite launch and JIT alias checks

[jserv]

Seal rewrite origin maps before publishing them so the fast path can no longer be retargeted by writable bitmap state at runtime. This moves the seccomp-filter handoff into sanitizer-free transfer helper and fail fast on the unsupported x64 ASAN trap/rewrite path instead of hanging after filter installation. This keeps guest transition deterministic on the validated hosts while preserving the existing seccomp path.

Reject executable shared-file aliases in trap/rewrite mode, and reject PROT_EXEC promotion when the target range overlaps a shared writable file mapping. That closes the guest-visible JIT alias path exercised by the new regression probe.

Add unit test for origin-map sealing plus guest rewrite regressions for the currently enforced JIT spray and alias boundaries. While touching these paths, clean up the pre-existing warning set by consuming checked I/O results, fixing the fault-handler identity check, and tightening linker segment flags.

Change-Id: I7a520db9e08ed2b7d1ac9adf5fca1fa1930f0a17

---

Summary by cubic

Hardens trap/rewrite execution to close a JIT alias path and make guest launch deterministic. Seals rewrite origin maps and fails fast on unsupported x64 ASAN builds.

• New Features

  • Seal rewrite origin maps (read-only, page-aligned mapping) before publish, making the fast path immutable.
  • New tests: unit test for map sealing; guest JIT-spray and JIT-alias regression probes.

• Bug Fixes

  • Block shared-file RX mappings and RX promotion over shared writable file mappings in trap/rewrite mode, preventing RW/RX aliasing.
  • Fail fast on x86_64 ASAN for trap/rewrite with a clear error; move seccomp handoff into a sanitizer-free transfer to avoid post-filter runtime syscalls.
  • Tighten build flags with -Wl,-z,noexecstack and -Wl,-z,separate-code; fix fault-handler identity check; consume I/O return values to clear warnings.

^{Written for commit 0000dab. Summary will update on new commits.}

[cubic-dev-ai]

No issues found across 16 files