fix(no-optimize): allocate stack frame + i64 local storage in select_with_stack

[avrabe]

Summary

Two AAPCS-violating bugs in synth's --no-optimize lowering of spilled wasm locals, both surfaced running pulseengine/gale (verified Rust kernel primitives) through synth on a real Cortex-M Zephyr engine bench.

1. i64 local storage dropped the upper half. LocalSet/LocalTee/LocalGet for spilled locals always used 4-byte Str/Ldr regardless of the local's wasm type. For i64 locals, only the lower 32 bits round-tripped; the upper bits were whatever happened to be in the register pair partner. For gale's u64-packed FFI decision structs ({action: u32, new_count: u32} packed), this corrupted the action field, breaking every ISR-driven semaphore operation in the engine bench (count=0 [drain_timeout] at every RPM step, 60-min Renode timeout).

2. Locals aliased the callee-saved spill area. The legacy offset formula (local_idx - 4) * 4 was hardcoded for num_params == 4 and produced negative offsets for other configurations, which the I64Ldr/I64Str encoder silently clamps to 0. Result: the locals were stored at [sp, #0] — exactly where stmdb sp!, {r4, r5, ...} had just saved r4 and r5. After ldmia, the caller saw its r4/r5 corrupted with the inner function's local values. Pure AAPCS violation.

Fix

• Add compute_local_layout(wasm_ops, num_params) that walks the wasm ops once to determine each non-param local's width (via infer_i64_locals) and assign stack offsets in ascending-index order with i64 locals 8-byte aligned. Frame size rounded up to 8 bytes for AAPCS SP alignment at call sites.
• Prologue: emit sub sp, sp, #frame_size after the callee-saved push.
• Epilogue (and explicit Return): emit add sp, sp, #frame_size before the pop.
• LocalGet/LocalSet/LocalTee dispatch on the layout entry: i64 locals use I64Ldr/I64Str (which already emit two 32-bit ops at offsets N and N+4); i32 locals use plain Ldr/Str. Offsets come from the layout, not the legacy formula.

Verification

/tmp/repro_i64.wat (1 i32 param + 1 i64 local round-trip):

Before: str.w r0, [sp]; (no upper store)
After:  sub.w sp, sp, #8;
        str.w r0, [sp]; str.w r1, [sp, #4];
        ldr.w r2, [sp]; ldr.w r3, [sp, #4];
        add.w sp, sp, #8; ldmia.

gale_k_sem_give_decide (3 i32 params + 1 i64 local):

Before: str.w r3, [sp]; str.w r5, [sp, #4]; — clobbered saved r4/r5
After:  sub.w sp, sp, #8 → str into locals frame, not spill;
        add.w sp, sp, #8 before ldmia — proper AAPCS preservation.

Engine-bench build with GALE_USE_SYNTH=ON now produces a 22768 B zephyr.elf (was 22692 B with the buggy synth). Renode validation pending in CI on the gale side.

Out of scope (separate work)

• Optimized-mode regalloc clobbers r0..r3. optimizer_bridge.rs::ir_to_arm hardcodes R0:R1 and R2:R3 for i64 ops, ignoring AAPCS parameter live-ins. Repro: /tmp/match_gale.wat. Affects the path without --no-optimize. Needs a separate PR — touches every Opcode::I64* arm.
• Implicit-return-to-R0 elision. Small functions whose final wasm result lands in a non-R0 temp don't get a closing mov r0, ? in --no-optimize mode. Pre-existing; affects addone-style i32-returning functions. Doesn't affect i64 returns (natural R0/R1 lowering).
• Br with depth ≥ stack emits bx lr without restoring callee-saved regs or deallocating the frame. Pre-existing.

Test plan

• cargo build --release --bin synth clean
• cargo install --path crates/synth-cli --force clean
• /tmp/repro_i64.wat round-trips correctly (both halves stored/loaded)
• gale_k_sem_give_decide produces proper AAPCS prologue/epilogue
• i32-only test cases (identity, addone, three_const) still produce valid code
• Engine bench links with GALE_USE_SYNTH=ON → 22768 B FLASH
• gale CI Renode bench passes (next step)

[avrabe]

Superseded by #86 — bundled into one CI-runnable PR per the medium-large PR strategy. Same diff is included in #86.