feat(kernel,hal): harden aarch64 EL0 smoke transition

[kernalix7]

Summary

• replace the 1 GiB EL0 RWX alias with dedicated 4 KiB RX code and RW/NX stack mappings
• add a guard page, stack-canary check, and two-SVC EL0 round-trip proof
• fail-stop unexpected lower-EL exceptions and scrub integer/SIMD state before privilege drop

Verification

• cargo fmt --all -- --check
• cargo clippy --workspace -- -D warnings
• cargo build --workspace
• AArch64 debug and release builds + QEMU EL0 SVC syscalls 6/8: ftruncate/waitid/fchmod-fchown/fdatasync + pread/pwrite/readv/writev #7/syscalls 7/8: *at family + statfs/sysinfo/getrandom + advisory + uname/time/creds (Workflow) #8 markers
• x86_64 QEMU userspace/shell integration
• RISC-V QEMU preemption regression
• ELF section, alignment, payload bounds, and register-scrub disassembly checks