fix(verify): arm64 stack save, adaptive canary and host gating

Assisted-by: GLM 5.3

verify/abi_report.go

@@ -47,7 +47,9 @@ func (r ABIReport) String() string {
 
 // redZoneSize is the canary window below the prepared stack pointer.  On
 // amd64 it is the System V red zone; on every architecture a Go function
-// must not write below SP, so any corruption there is a bug.
+// must not write below its own declared frame, so the canary sits below
+// the frame plus the call margin (see CallCheckedFrame) and any corruption
+// there is a bug.
 const redZoneSize = 128
 
 // redZoneFill is the byte pattern used to detect writes below SP.