runtime: bound external PREPARE stack usage

[thanks-cohn]

Motivation

• The enlarged 584-page PREPARE metadata was inlined into the cumulative supervisor startup frame, crossing the explicit 60 KiB supervisor stack bound and corrupting adjacent BSS, which prevented the machine from reliably reaching external PREPARE/COMMIT and progressing the apk info ladder.
• Make the smallest general, capacity-bounded repair so PREPARE/COMMIT semantics and the 584-page capacity are preserved while removing capacity-proportional stack growth.

Description

• Prevent inline expansion of the external execution phase by marking executeExternalArtifact as noinline and preserving the supervisor stack bound so startup cost no longer scales with PREPARE capacity. (recipes/run-hosted-morphic-runtime/src/freestanding_riscv64.zig)
• Move capacity-sized PREPARE metadata into existing bounded global candidate slots by creating/using external_exec_image_candidate and external_exec_interpreter_image_candidate and update preflight/commit plumbing to use those candidates instead of inlined temporaries. (recipes/run-hosted-morphic-runtime/src/freestanding_riscv64.zig)
• Adjust external_next_backing and the PREPARE preflight/commit paths to use the new candidate values so backing and mapping counts remain consistent and failure-atomic. (recipes/run-hosted-morphic-runtime/src/freestanding_riscv64.zig)
• Regenerate and update repository validation evidence (generated/validation/modules.json), add a detailed handoff report (docs/reports/AGENTIC_SNOWBALL_BATCH_32W.md), and record the runtime facts in COMMANDS.md.

Testing

• zig build test-recipe-run-hosted-morphic-runtime passed and the focused recipe tests covering table/backing rounding and the 33rd mapping proof succeeded.
• Built and installed the freestanding Morphic runtime with zig build install-freestanding-riscv64-morphic-runtime and exercised it under QEMU 8.2.2, which now reaches external namespace lookup, PREPARE (elf, image, stack, tables), COMMIT, and execute.
• The immediate unchanged /sbin/apk --version ladder did not complete: the run exposed a supervisor Sv39 walker load fault involving a user-derived table address at 0x4001b000, so /sbin/apk --version, /sbin/apk --help, and apk info are not proved in this run and the 391-page allocation was not re-proved.
• Repository-level validations were regenerated and run: zig build check --summary all and python3 tools/developer-command.py validate-repository completed successfully (canonical evidence regenerated), and PYTHONDONTWRITEBYTECODE=1 python3 tools/check-command-reference.py --check passed.

---

Codex Task