Sandbox hardening for untrusted code

The native and WebAssembly sandboxes are hardened for arbitrary hostile input, one day after ARM64 gets its first JIT tier.

e89612a6 (24 August) hardens the sandboxes and adds the guarded ARM64 baseline JIT: bounded call-free integer functions and numeric loops with exact-ip fallback, no helpers, no OSR yet, and a bespoke W^X path on Windows ARM64. 4195e063 continues the hardening for untrusted code: compile-time forbid(unsafe_code) under safe-sandbox, a compile error if safe-sandbox and jit are combined, and separate workspaces so feature unification cannot reintroduce a JIT.