Loop generalization, BSR/BSF intrinsics, and stack alloca split

[NaC-L]

Loop generalization, BSR/BSF intrinsics, and stack alloca split

This PR fixes a class of correctness and IR-quality bugs in the loop generalization machinery, the BSR/BSF semantics, and the pseudo-stack promotion pipeline.

Commits

1. loop generalization: data-driven register preservation + multi-slot carried state

   • Replaces the hardcoded Themida-specific register preserve set {1,4,7,9,10,12,14} with a data-driven comparison of canonical vs backedge values. A register is preserved when its value changed across the loop boundary; RSP is always preserved.
   • For dispatcher-shaped loops (Themida cursor slot detected), falls back to the hardcoded set so LLVM can fold scratch noise and resolve imports.
   • Adds carriedSlots vector tracking ALL varying memory qwords during loop generalization, not just controlSlot + targetSlot. Fixes the TEA-round class of bugs where a third+ varying slot was silently dropped. The retrieve_target_slot helper now checks carriedSlots after the legacy targetSlot, building phis for any matching carried address.
   • Emergency generalization escape hatch: when BB count exceeds 75% of maxBasicBlockBudget and a backward target has 4+ visits, allow generalization regardless of path-solve context. Prevents budget exhaustion from concrete unrolling of stack-array-indexed dispatch loops.

2. add vm_subroutine_loop — single-depth call/ret VM with indirect PC dispatch. Previously crashed the lifter with an access violation. 8 semantic cases pass.

3. add vm_callret_loop and vm_bubblesort_loop — patterns that previously exhausted the BB budget (~4087 blocks). Both lift cleanly under the emergency generalization at 75/59 blocks respectively. Pattern-only entries (no semantic assertions: indirect dispatch and conditional multi-slot writes are not yet semantically accurate under generalization).

4. semantics: rewrite BSR/BSF to use llvm.ctlz/cttz intrinsics

   • Replaces the bitWidth-iteration unrolled bit-scan loops with single @llvm.ctlz / @llvm.cttz intrinsic calls. BSR = bitWidth - 1 - ctlz; BSF = cttz.
   • Zero-input case handled with is_zero_undef=true plus an explicit select that returns undef.
   • Fixes flag-stress tests bsf_00 and bsf_01 (constant-folded input now produces correct PF flag).
   • vm_imported_clz_loop and vm_imported_bsr_loop now show a single call @llvm.ctlz.i32 instead of 30+ AND/ICMP/SELECT instructions.

5. PromotePseudoStackPass: split into main + escape alloca by call-escape

   • Main alloca: scratch slots that don't escape via calls. SROA decomposes it cleanly; DSE eliminates dead stores.
   • Escape alloca: slots whose pointer flows into a CallBase. Won't SROA but is isolated, so dispatcher noise doesn't block its dead-store elimination.
   • Classification by constant offset: any offset touched by ANY GEP with a CallBase user is marked escaped. Preserves pointer identity within each escaped slot.
   • Themida WriteConsoleA call now shows clean alloca GEPs (stackmemory.escape + N) instead of inttoptr (i64 1375584 to ptr). Stack-range inttoptr in Themida output drops to zero.

Test results

Test	Result
test.py micro --check-flags	All pass
test.py quick	250 samples, 247 semantic / 2358 cases
test.py negative	All pass
test.py flags	bsf_00/_01 fixed (2 fewer failures vs main); same other failures as main
test.py vmp	2/2 required pass
test.py themida	4 imports, 7 calls (gate green)
test.py coverage --full	116/120 handlers (+1 vs main)
Golden hashes	42/42 match

New test samples

• vm_tea_round_loop (10 cases) — TEA-style 3-slot cross-update including the previously-failing x=0x65501 input
• vm_subroutine_loop (8 cases) — was crashing
• vm_callret_loop (pattern only) — was budget-blown
• vm_bubblesort_loop (pattern only) — was budget-blown