fix(verify): arm64 stack save, adaptive canary and host gating

Assisted-by: GLM 5.3

verify/groundtruth_test.go

@@ -82,6 +82,22 @@ func TestGroundTruthBadFile(t *testing.T) {
 	}
 }
 
+// TestGroundTruthCrossEnvGOARCH checks that a GOARCH exported in the
+// ambient environment does not override cross-assembly: the child
+// assembler must honour the requested GOARCH even when the environment
+// already carries a GOARCH entry (os.Getenv reads the first entry, so a
+// duplicate would win).
+func TestGroundTruthCrossEnvGOARCH(t *testing.T) {
+	t.Setenv("GOARCH", "amd64")
+	gt, err := GroundTruthARM64("../testdata/verify/basic_arm64.s")
+	if err != nil {
+		t.Fatalf("GroundTruthARM64 with ambient GOARCH=amd64: %v", err)
+	}
+	if len(gt) == 0 {
+		t.Fatal("no functions extracted from ground truth")
+	}
+}
+
 func keys(m map[string][]byte) []string {
 	out := make([]string, 0, len(m))
 	for k := range m {