fix(verify): arm64 stack save, adaptive canary and host gating

Assisted-by: GLM 5.3

verify/call_amd64.go

@@ -58,6 +58,10 @@ const stackPad = 64
 //
 // The function must be NOSPLIT (no stack growth) and must not reference
 // external symbols, the image is self-contained.
+//
+// Not safe for concurrent use: only one JIT call may be in flight at a
+// time, the trampolines keep the saved registers in package globals
+// (savedSP and friends).
 func Call(fnAddr uintptr, args []byte) ([]byte, error) {
 	// Prepare the stack: [padding][leaveJIT addr][args...]
 	stackSize := stackPad + 8 + len(args) + 64 // padding + ret + args + safety