codegen: lower try/catch to LLVM invoke/landingpad, delete the setjmp/longjmp path #7302

Perry lowers try/catch to setjmp/longjmp (perry-codegen/src/stmt/try_stmt.rs; zero uses of invoke today). That single choice causes three separate problems:

1. Precise moving-GC roots are unsound in try functions — a longjmp can jump past a gc.statepoint's gc.relocate, so the relocated pointer's write-back never runs. This is why the statepoint experiment (gc: RewriteStatepointsForGC over managed-pointer SSA — the measured-only road to native-root file-size parity #7174) excludes has_try functions and routes them to a plain-stack-map fallback that is itself unsound (root slots recorded as caller-saved registers; 3/60 locations on one probe). Under RS4GC, mem2reg cannot promote the volatile allocas setjmp requires, so try-region roots never enter SSA and never join a gc-live bundle.
2. ~570 lines of machinery exist only to fight the register allocator: volatile_setjmp.rs (376) + setjmp_abi.rs (193) implement C99 7.13.2.1p3.
3. Every try function is pessimized: returns_twice + #1 (noinline) on the whole function.

Moving to invoke/landingpad collapses all three and is the prerequisite for #7174 deleting its unsound has_try fallback (statepoints can then cover every function).

Plan

• Phase 0 (done) — standalone spike: invoke + landingpad + catch-all against a _Unwind_RaiseException throw path. All green on macOS arm64, including bit-exact NaN-box payload round-trip, nested rethrow, finally re-raise, uncaught. Decisions: Perry-owned perry_eh_personality (Itanium LSDA walk; no libc++abi, no dependence on rust_eh_personality); thrown value stays in the GC-rooted TLS slot (landing pad ignores {ptr, i32}); js_throw keeps its savepoint restores and raises; js_call_catching keeps its Rust-boundary longjmp trap (Rust cannot catch foreign exceptions; a raise never crosses an open js_call_catching frame).
• Phase 2 (measured early) — cross-Rust-frame unwinding matrix: panic=unwind aborts on any helper with an interior Rust call site (RFC 2945 abort guards); panic=abort with default flags strands the exception (no unwind tables); panic=abort + -C force-unwind-tables=yes is exactly longjmp-equivalent (caught, Drops skipped) and keeps the at-throw savepoint restores correct unchanged. The mass-extern "C-unwind" alternative was measured and rejected (abort-on-missed-annotation; incompatible with panic=abort).
• Phase 1 (in progress) — full codegen lowering behind a temporary PERRY_EH flag: every potentially-throwing call inside an active handler scope becomes an invoke; rethrows in catch/finally wire to the enclosing pad (spike-confirmed rule); async rejection boundary converted the same way.
• Phase 3 (merge gate) — flip the default, delete volatile_setjmp.rs, setjmp_abi.rs, the returns_twice/#1 handling and the flag itself. A PR leaving both paths in place must not merge.
• Windows (x86_64-pc-windows-msvc, CI-exercised) — no Itanium unwinder there; SEH funclet form planned (RaiseException + catchswitch/catchpad, personality __C_specific_handler, fixed filter matching a Perry-owned exception code). Shared invoke-conversion infrastructure; per-triple dispatch/landing shape (as setjmp_abi selects per-triple today).

Acceptance

• Gap suite byte-for-byte vs the pinned Node oracle; exception-heavy corpus extended with every Phase-1 edge (normal/caught/rethrown, finally on both edges, return-inside-try, nesting).
• New GC probe: allocate inside try, throw across a collection point, verify caught value + surviving locals (none exists today — which is why the unsound fallback went unnoticed).
• Perf on try/catch-heavy microbenchmarks, both directions.
• Line delta strongly negative.
• "Subject was live" assert: emitted IR grepped for invoke/landingpad; runtime carries a self-check for unwind-table presence (a stray RUSTFLAGS dropping force-unwind-tables must fail loudly, not strand throws).

Design doc: docs/invoke-eh-experiment.md on branch exp/invoke-eh.