RS4GC: 02_survivor_promotion segfaults under forced evacuation on aarch64-ELF #7392

Split out of #7390, which fixed the two compile failures that were masking this.

State after #7390

The native-roots-rs4gc (ubuntu-24.04-arm, aarch64, ELF) arm now gets much further:

Wrote executable: /tmp/rs4gc-01_nursery_churn      ← compiles AND runs
#gcmetric heap_used_bytes=9728392                  ← collector reported
Wrote executable: /tmp/rs4gc-02_survivor_promotion ← compiles AND links
Segmentation fault (core dumped)  PERRY_RS4GC=1 PERRY_GC_FORCE_EVAC…

Before #7390 the arm could not compile a single module, so this crash had never been reachable. It is not a toolchain gap — it is a GC correctness bug in statepoint lowering, in exactly the mode the arm exists to test.

Why 02_survivor_promotion specifically

The probe exercises the promotion path under PERRY_GC_FORCE_EVACUATE, so the likely shape is a root the statepoint lowering fails to relocate across a promoting collection — as opposed to the plain nursery evacuation that 01_nursery_churn survives.

The question worth answering first

macOS aarch64 uses the same statepoint lowering. If this were lowering-generic it should fail there too. So either:

• it is ELF-specific (different frame layout, different register allocation), or
• the macOS arm has never actually run this probe

Given this repo's recent record of arms that queue and never execute (three of the four RS4GC arms have sat pending on every run I checked today), the second possibility needs ruling out by evidence rather than assumption. That check is cheap and should come before any lowering investigation.

Notes

• Not reproducible on macOS directly; the crash is in generated code, so a traced ELF build plus the probe IR may localise it without a Linux host — the same approach that cracked the parse bug in fix(gc): parse GNU-as symbol assignments in the stack-map block #7390.
• Related: gc(layer 3): from-space quarantine catches 55 stale dereferences across the gap suite — the instrument is in CI but aimed at one synthetic fixture #7341 (from-space quarantine), Engine plan tracker — GC correctness and performance (routing only; docs/engine-plan.md is authoritative) #7294 (engine plan, layer 2).