fix(verify): arm64 stack save, adaptive canary and host gating

Assisted-by: GLM 5.3

verify/call_riscv64.go

@@ -28,6 +28,9 @@ func init() {
 const stackPad = 64
 
 // Call invokes the assembled function at fnAddr with the given ABI0 argument block.
+//
+// Not safe for concurrent use: only one JIT call may be in flight at a
+// time, the trampolines keep the saved registers in package globals.
 func Call(fnAddr uintptr, args []byte) ([]byte, error) {
 	stackSize := stackPad + 8 + len(args) + 64
 	stackMem, err := syscall.Mmap(-1, 0, stackSize,