Count JALR return sites in loop promotion

[thc1006]

compute_promotions() counts the return site of a direct jal ra, ...
as an external loop entry, but misses the return site of a resolved
jalr ra, .... successors() and return-site collection treat both
as calls. A loop entered through the jalr ra, ... return can
therefore look single-entry, so promotion attaches its preload only to
the direct-jump entry and execution through the return reads a zeroed
promotion cell.

The image below loads the word at address 84, increments it, stores it
back, then writes its low byte. The image emitted by main writes
0x01; the guest program should write B (0x42).

05400513,00100393,00000293,00028663,
0100006f,00000013,05000413,000400e7,
00052303,00130313,00652023,fff38393,
fe0398e3,00100513,05400593,00100613,
04000893,00000073,05d00893,00000073,
00008067,00000041

Use a shared is_link_call() predicate in successors(),
compute_promotions(), and return-site collection. Add an executable
regression that lowers and runs the image and requires the exact output
B.

The differential fuzzer does not cover this shape because generated
loop bodies contain no nested control flow. The current RV32I test
ELFs, including rv32ui, lower to byte-identical images before and
after this change.

make check-all passes.
make fuzz-rvopt passes.

---

Summary by cubic

Fix loop promotion to count return sites from resolved jalr ra, ... calls, so loops entered via a jalr return get the preload. Unifies call detection and adds a regression that must print B.

• Bug Fixes
  • Added is_link_call() and used it in successors, loop promotion, and return-site collection to treat jal ra and resolved jalr ra consistently.
  • Added a hand-encoded image and verify-mux check (RVOPT_LOOPCALL_ENC) that fails if the loop preload is bypassed; expects exact output B.

^{Written for commit 0fd2320. Summary will update on new commits.}

[jserv]

Thank @thc1006 for contributing!