feat(verify): ABI checks on arm64, riscv64 and loong64

Assisted-by: GLM 5.3 Flash

docs/ARCHITECTURE.md

@@ -360,7 +360,15 @@ and returns).  A 64-byte pad below the return address accommodates the
 ABIInternal wrapper that the Go runtime interposes on assembly functions.
 Every supported architecture carries its own hand-written trampoline pair
 (`trampoline_amd64.s`, `trampoline_arm64.s`, `trampoline_riscv64.s`,
-`trampoline_loong64.s`), so `Call` works wherever the toolkit runs.
+`trampoline_loong64.s`), so `Call` works wherever the toolkit runs.  The
+ABI-checked variant `CallChecked` exists for every architecture too:
+`enterJITChecked` plants sentinels in the registers the Go ABI fixes across
+calls (amd64 `BP`/`R14`, arm64 `R29`/`R28`, riscv64 `X27`, loong64 `R22`;
+the latter two keep no hardware frame pointer) and the raw return trampoline
+`leaveJITCheckedRaw` verifies them, so `-abi` reports frame-pointer,
+goroutine-pointer and below-SP violations on every supported host.  `gasm
+verify` dispatches by host: the JIT checks run when the host matches the
+kernel's architecture, and only the toolchain comparisons run elsewhere.
 
 `Load` / `LoadSource` / `LoadAST` parse, assemble and map a `.s` file in one
 step, returning a `Kernel` whose `CallFunc` method marshals the argument block