#255 --hosted binaries segfault on any GC: collect-entry dispatch jumps to garbage vaddr

Any --hosted-produced a.out that triggers a collection dies with SIGSEGV — both an explicit (gc) call and a natural collection (allocating past the 2 GiB boot nursery, e.g. (dotimes (i 160000000) (cons i i))).

Verified pre-existing at b6b8c5e (pristine worktree build, 2026-07-08): identical segfault with and without the FUNCL_MAX_HEAP work, so hosted binaries have never survived a collect.

gdb on the crash: PC = 0xffffffffc02f56e8 (sign-extended garbage), called from main; R15 = 0x87ffffff8, R13 = 0x880000000 — exactly the boot-window exhaustion slow path. gc-emit-call-collect-body loads the stub vaddr from the +heap-gc-collect-entry-vaddr-offset+ (+288) slot and call-r11's it; in hosted output that slot evidently holds junk (stub not emitted into the a.out, or gc-emit-collector-init's publish missing/mis-offset on that path — gc-trampoline-vaddr-for reads compile-process state).

Consequence: --hosted programs are limited to < 2 GiB total allocation, and the FUNCL_MAX_HEAP ceiling (cave#254) cannot protect hosted binaries until this is fixed (its check lives in GC-COLLECT, which is never reached).