feat(verify): add runtime ABI checks with sentinel registers and red-zone canary

Assisted-by: Qwen 3.8 Max Preview

verify/abi_other.go

@@ -0,0 +1,26 @@
+// Copyright (c) 2026 Petr Balvín <opensource@petrbalvin.org> (https://petrbalvin.org)
+// SPDX-License-Identifier: BSD-3-Clause
+
+//go:build !amd64
+
+package verify
+
+import "fmt"
+
+// ABIReport describes the result of an ABI-checking call.
+type ABIReport struct {
+	BPClobbered  bool
+	R14Clobbered bool
+	RedZoneHit   bool
+}
+
+// OK returns true when no violations were detected.
+func (r ABIReport) OK() bool { return false }
+
+// String returns a human-readable summary.
+func (r ABIReport) String() string { return "verify: ABI checks require amd64" }
+
+// CallChecked is unavailable on non-amd64 architectures.
+func CallChecked(fnAddr uintptr, args []byte) ([]byte, ABIReport, error) {
+	return nil, ABIReport{}, fmt.Errorf("verify: ABI checks require amd64")
+}