perf(coro): flatten certified native syscall chains

[cpunion]

Summary

• introduce a fail-closed ProgramIR recipe for compiler-certified synchronous native blocking calls
• propagate no-unwind static outcomes through exact Go call chains and library summaries
• call native syscalls on the current M after releasing the managed domain, while retaining replacement-M compensation
• keep timer, poll, host, dynamic, retained, and generic worker operations on their existing suspend paths
• add production Darwin stdlib, lowering, retention, ABI, and negative gates

Verification

• focused internal/coro, internal/build, and cl suites pass
• runtime coroutine/syscall-worker module gates pass
• actual LLVM 22 standard-file, direct-syscall, blocking-pipe-with-timer, and loopback-TCP executions pass with GOMAXPROCS=1
• production output exports $outcome for syscall.syscall, Read, Write, and Seek; coro_resume symbols fall from 1,859 to 1,792

Performance checkpoint

Go 1.26.5 / LLVM 22.1.8 / Darwin arm64 / full LTO / interleaved process medians:

• direct file syscall: 2.07x Go -> 1.49x Go (-26.8%)
• standard file path: 4.94x Go -> 3.89x Go (-19.9%)
• loopback TCP: 2.03x Go, effectively unchanged
• parked-goroutine incremental RSS: about 1,948 B/g versus Go 2,800 B/g (-30.4%)
• LLGo I/O text: -86,444 bytes (-2.39%)

The full data and compatibility boundary are recorded in doc/coro-performance-baseline.md. The base branch remains 101 upstream-main commits behind at this checkpoint; upstream synchronization and full repository/GOROOT acceptance are the next separate integration gate.