LATX: reduce indirect jump lookup overhead

[luzeng87]

Summary

• enlarge the LATX x86-64 per-CPU jump cache from 16 to 19 index bits
• use low guest-address bits directly in runtime and generated FastTB lookups
• add a 20-bit open-addressed secondary cache for translated indirect-jump targets
• keep the secondary-cache miss path inside translated code and promote valid hits into FastTB
• remove entries during TB invalidation and clear the table during a full TB flush
• preserve AOT relocation for the secondary-cache miss path

Correctness

The secondary cache stores TranslationBlock *, not only a guest PC and code pointer. A hit must match pc, flags, and cflags; an invalidated TB therefore cannot match. Multiple TB variants at the same guest PC remain independently addressable.

The current TB pointer is passed in a7 only after a FastTB miss. This avoids clobbering the LoongArch return-address register and leaves the primary FastTB hit path unchanged.

An empty slot or one complete probe cycle returns to the regular dispatcher and QHT lookup. Tombstones preserve probe chains and are reused by later insertions.

Validation

• focused unit test covers same-PC variants, collisions, tombstone reuse, invalid TB rejection, a full table, and full-table miss termination
• clean 3A6000-25G O1 build on current master: passed
• lat-pr-fast: 25/25 passed
• 21 standalone instruction fixtures: 21/21 JIT passed
• the same 21 fixtures: cold AOT and two hot-AOT runs passed with non-empty .aot2 files
• pairwise merge checks against LATX: translate AES and VAES encryption rounds directly #432, LATX: optimize AVX and IR2 instruction generation #438, and LATX: expose implemented F16C and LZCNT features #440: clean

This PR remains a draft pending review, CI, and final performance regression testing.

[luzeng87]

Added c04868cbd9 after a clean-build regression exposed return-address clobbering in the secondary-cache glue. The first version allocated eight integer temporaries although x86-64 LATX provides seven, allowing the hash multiplier to occupy ra. The fixed lookup uses five temporaries and index masking for wraparound. The original reproducer changed from rc=139 to rc=0; JIT, cold AOT, hot AOT, Fast Suite 24/24, and the 624-test daily status comparison all passed.