Stop brk growing through its neighbors

[jserv]

sys_brk bounded a new break only by guest_size. Everything from the heap up to MMAP_RX_BASE is one premapped RW span and a grow re-maps what it crosses, so an unbounded grow did not fault: it extended page tables over the guest stack, zeroed the range it had just handed the guest, and returned success. The guest saw its own stack replaced by zeroes, which surfaces later and elsewhere as corrupted heap metadata or a jump through a null pointer.

A grow now stops at the first tracked region above the break and returns the unchanged break, which glibc and musl read as "no more heap" before falling back to mmap. Nothing is exempt from that, the heap's own record included: two drafts exempted it by name and both turned out to be reachable, because mremap keeps the source region's name.

Four more defects around it were found the same way and are fixed here. A heap hole left the pieces above it stranded, wedging the heap for the life of the process in 48 measured shapes. A growth adopted a sealed neighbour's prot, so the next mprotect took its same-prot fast path and left the pages writable. The fallback record spanned pages that had no page-table entries. The stale-tracker flag outlived the execve that rebuilt the table it doubted, which static glibc does not survive. Image placement also leaves a minimum window above the break and is bounded by MMAP_RX_BASE, so an ET_EXEC linked near 250 MiB is refused rather than placing its stack on the mmap RX region, and execve asks for that placement before its point of no return so the guest gets ENOEXEC instead of the VM going down with exit(128).

A terminating EL0 fault now reports its address, PC and ESR at warn level rather than only under --verbose, for SIGILL as well as SIGSEGV. That is the diagnostics gap #320 also named: the reporter had to rebuild with the line promoted before they could see it.

Left out deliberately: a capacity pre-merge in guest_region_add_ex_owned_gpa was written and then removed, because no guest-reachable path exercised it. Five follow-ups are filed rather than folded in, including a fatal signal that ends only the faulting thread instead of the thread group, and the 104 MiB heap window itself, which this bounds rather than widens.

Closes #320

---

Summary by cubic

Fixes sys_brk growing through its neighbors, which could overwrite the guest stack and silently corrupt heap metadata (issue #320).

• A grow now stops at the first tracked region above the break and returns the unchanged break; glibc and musl fall back to mmap.
• Fixes four related defects: a heap hole that wedged the heap for the process's lifetime, a growth that adopted a sealed neighbor's prot and left grown pages writable, a fallback record spanning pages without page-table entries, and a stale-tracker flag that outlived execve.
• Heap and stack placement now leaves a minimum window above the break and is bounded by the mmap RX region; execve refuses images that leave no room with ENOEXEC instead of exit(128).
• A terminating EL0 fault now logs its address, PC, and ESR at warn level for both SIGILL and SIGSEGV, not only under --verbose; the SIGILL line describes the branch as a non-abort exception and carries the EC rather than claiming an undefined instruction.
• Verified on macOS 26 / Apple silicon: make check, the full test matrix, make verify-brk (11 of 11 obligations), and the new test-brk-stack suite all pass.

^{Written for commit 4f200a9. Summary will update on new commits.}