Fix hotpatch TLS, symbol mapping, and loader publication

[jkelleyrtp]

Scope and stacked follow-up

The WASM allocation/layout changes have been split into #5809, which is based on this branch. This PR no longer changes JumpTable or subsecond-types. It can be merged without accepting the public-type/wire-format extension.

The WASM BSS/table-allocation fixes are intentionally deferred to that follow-up. Applying both PRs reproduces the previously tested combined implementation exactly.

Summary

Fix native binary-patching correctness issues and independent loader/publication issues found during the hotpatch audit.

Native binaries

• Forward Mach-O TLS accesses to the original TLV descriptor instead of guessing initializer sizes or copying unrelocated bytes. Preserve zero-filled storage, alignment, pointer fixups, and per-thread state; preserve the registers used by the forwarding thunks.
• Preserve ELF TLS alignment and apply absolute, relative, and RELR initializer relocations on x86-64/AArch64. Reject unsupported initializer relocations rather than constructing invalid pointers.
• Build jump tables from the full function symbol table so merged aliases survive. Reject diverging folded functions and ambiguous native symbol names instead of choosing a target arbitrarily.
• Preserve absolute-symbol addresses, restrict __imp_ normalization to Windows, and reject direct redirection to GNU IFUNC resolvers.
• Propagate symbol/parser/linker failures and terminate compiler/linker subprocesses when their build task is dropped.

Independent WASM and publication hardening

• Support expression-based function-table entries, handle patches without element segments, and avoid duplicating the global-relocation export.
• Do not publish patches whose initialization fails or whose asynchronous load has been superseded.
• Publish native jump tables with release/acquire synchronization, initialize the ASLR sentinel with OnceLock, and invoke reload handlers after releasing their registry lock.

Limits

• Ambiguous mappings, GNU IFUNC stubs, Android packed TLS relocations, and unresolved dynamically bound ELF TLS initializer targets produce rebuild-required errors. This is a safe refusal, not complete support for those layouts.
• This does not establish safety for arbitrary Rust type/layout changes or redesign the HotFn API.
• Native Windows/iOS/Android loading and a full browser/application hotpatch session were not executed locally. Passing local tests are not an exhaustive cross-platform safety guarantee.

Test plan

• git diff main -- packages/subsecond/subsecond-types/src/lib.rs — no changes to the public jump-table type.
• cargo test -p dioxus-cli --bin dx --locked — all 170 tests pass after the split.
• cargo test -p subsecond-types -p subsecond --lib --locked — the runtime publication test passes; no layout tests remain in subsecond-types.
• cargo check -p subsecond --target wasm32-unknown-unknown --locked.
• Formatting and diff checks.
• Real Clang-generated Mach-O dylibs: load the generated stub and verify original TLS identity, pointer initialization, and alignment on two threads.
• Clang/LLD ELF fixtures for x86-64 and AArch64, with absolute/relative/RELR pointer initializers.
• Cross-platform CI and native Windows/iOS/Android runtime validation.

Generated with Devin