feat(emit): dual-emit runtime + harden artifacts

[undivisible]

Summary

• Add --dual-emit and --harden-out to in compile / in build so one invocation writes two artifacts: a runtime object (default or lean, no harden transforms) and a separate harden anti-decomp sample.
• --harden-out with --out implies dual-emit; otherwise --dual-emit derives foo-harden.o from --out. Dual-emit rejects --harden / --profile harden so the hot-path runtime emit never gets CFG _pc / alien MBA shapes.
• Docs (docs/emit-profiles.md) and scripts/ghidra-antidecomp-smoke.sh updated to prefer one-shot dual-emit for size/objdump metrics.

Test plan

• cargo test --lib dual_emit (resolve helpers + owned_compile dual artifacts)
• cargo test --lib runtime_profile_has_no_cfg_pc_dispatch
• cargo test --lib harden_profile_keeps_cfg_pc_dispatch
• cargo test --bin in dual_emit (CLI parse + dual write)
• cargo clippy --all-targets -- -D warnings
• cargo fmt --check
• CI green on this PR
• Optional: scripts/ghidra-antidecomp-smoke.sh locally when native backend available

Notes

• Base: 1c9a902 (feat(harden): alien-emit rethink — CFG dispatch lite + native MBA pads #332 alien-emit).
• Implementation driven by grok CLI (omp/opencode glm-5.3 unavailable: ZAI 429 insufficient balance + OpenCode insufficient balance). Mac worktree created but host flapped; work done on box worktree /workspace/inauguration-dual-emit.
• Prefer open + report; do not merge until CI fully green and content-checked.

---

Note

Medium Risk
Changes default compile/build behavior when new flags are used (double pipeline runs) and encodes profile orthogonality in CLI validation; core emit paths are unchanged unless dual-emit is requested.

Overview
Adds dual-emit so in compile and in build can write two outputs in one invocation: a runtime artifact (default or lean, no harden IR/codegen) to --out, and a separate harden anti-decomp sample to --harden-out (or a derived *-harden path when only --dual-emit is set).

New CLI flags --dual-emit and --harden-out are wired through EmitProfile::resolve_dual_emit, which rejects combining dual-emit with --harden / --profile harden and requires distinct paths. cmd_compile and cmd_build run the pipeline twice when dual mode is active (runtime profile first, then EmitProfile::Harden).

Documentation and scripts/ghidra-antidecomp-smoke.sh now prefer one-shot dual-emit instead of two separate profile compiles. Tests cover path derivation, flag parsing, artifact differences (_H symbols only in harden), and IR invariants that default/lean must not insert CFG _pc dispatch while harden keeps it.

^{Reviewed by Cursor Bugbot for commit d57ea0d. Configure here.}

[capy-ai]

Capy couldn't review this pull request because Max's workspace is out of credits, add credits or enable auto-reload to resume automatic reviews.

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_8ae6e03f-8e01-4a58-8802-baa5836235b1)

[mergify]

Tick the box to add this pull request to the merge queue (same as @mergifyio queue).

• Queue this pull request