#288 Pre-existing at HEAD: (save-image) at stage1 REPL SEGFAULTS — AG-SAVE-IMAGE-ACTION stores to a lexical slot past the stack top (test funcl-stage1-save-image-restart-evaluates red)

The sharded suite's funcl-stage1-save-image-restart-evaluates fails at clean HEAD b6b8c5e (verified on an untouched worktree build — NOT caused by the 2026-07-11 ADR-0028 stack; that run's only failure is this one).

Repro: printf '(save-image "/tmp/t.img")' | build/funcl-stage1 → SIGSEGV (the SAVE, not the restore).

gdb (AOT warm code — symbols work): #0 0x52354c AG-SAVE-IMAGE-ACTION+60: mov %rax,0x1f48(%rsp) <- faulting STORE rsp = 0x7fffffffd118, stack VMA ends 0x7ffffffff000 -> rsp+0x1f48 = 0x7ffffffff060 is PAST THE STACK TOP.

I.e. the function addresses a lexical slot ~1000 words ABOVE its entry rsp — the deep-lexical-frame disp32 store (emit-store-rax-rsp-disp) with a bogus offset: a depth-accounting / frame-layout miscompile in whatever recent commit changed ag-save-image-action's shape or its callers, OR the function genuinely expects a huge operand stack that the REPL dispatch no longer provides. Needs a bisect over recent commits (suite wasn't run at HEAD; cave#285 documents two other pre-existing test failures).

Related (blocked-behind): ADR-0028 closure records also need image-layer serialization — support is written (tag 7, vector-shaped, entry via the cave#243 verbatim code-pointer encoding) but can't be validated until save completes.