Harden JIT spray for rewrite and trap exec paths

[jserv]

Close the remaining JIT spray gap in the syscall rewrite fast-path by hardening executable promotion instead of patching runtime-generated code in place.

This change keeps the earlier origin-map sealing and shared-file alias protections, then finishes the runtime side of the threat model:

• reject writable-plus-executable mappings in trap/rewrite mode
• reject executable promotion of shared writable file aliases by backing object overlap, not just VMA shape
• scan writable-to-executable promotions and fail closed when promoted region contains syscall instructions
• require the rewrite security guest probes during integration when rewrite mode is available

The scan-on-X path is intentionally conservative. For aarch64 it reuses the existing SVC site detector. For x86_64 it performs a raw byte sweep for 0f 05 and 0f 34 so hidden misaligned syscall encodings are blocked too, rather than relying only on instruction-boundary decoding.

The mprotect hook now applies in both active rewrite runtime and x86_64 trap fallback. That matters on node1, where --syscall-mode=rewrite still falls back to trap in release builds; the JIT spray boundary must still be enforced there.

Change-Id: I01f3000b8b1d94e1b1ed300ff18b352eb496416a

---

Summary by cubic

Hardens executable promotion in rewrite and x86_64 trap paths to close the remaining JIT spray gap. RW→RX promotions are now scanned for syscall sites, and shared-file executable aliases are blocked at mmap/mprotect time.

• New Features
  • Scan-on-X for RW→RX; deny if syscall instructions are found (x86_64: raw sweep for 0f 05/0f 34; aarch64: SVC detector). Applies in both active rewrite and x86_64 trap fallback.
  • Shared-file alias protection: match by dev/inode and file-offset overlap; reject RX mmap/mprotect when a writable MAP_SHARED alias overlaps.
  • Integration: run-tests.sh probes rewrite support; requires jit-spray-test and jit-alias-test when available; auto-skips on x86_64 ASAN; fails when rewrite mode is unavailable.

^{Written for commit 0000597. Summary will update on new commits.}