fix(verify): arm64 stack save, adaptive canary and host gating

Assisted-by: GLM 5.3

verify/abi_loong64.s

@@ -64,3 +64,14 @@ g_ok:
 	JMP  (R1) // return to Go caller
 
 GLOBL savedG(SB), NOPTR, $8
+
+// leaveRawAddr holds the raw .abi0 address of leaveJIT, read by
+// call_loong64.go in preference to reflect.ValueOf(leaveJIT), which returns
+// the address of the ABIInternal wrapper the linker interposes: the
+// wrapper's prologue clobbers the saved-register window the JIT call
+// depends on.  It lives here rather than beside leaveJIT in
+// trampoline_loong64.s because that file is assembled by gasm itself in
+// the ground-truth byte tests, and gasm cannot yet encode a symbol-valued
+// DATA word.
+GLOBL ·leaveRawAddr(SB), NOPTR, $8
+DATA ·leaveRawAddr(SB)/8, $·leaveJIT(SB)