SMCChecks=mtrack does not track code writes by the kernel through read-like syscalls

x64 [racket](https://racket-lang.org/) crashes under emulation:
```
$ racket hello.rkt
Error: error reading from ~a
("petite")
Aborted (core dumped)
```
Racket CS embeds its petite, scheme and racket.so boot images as sections in its own executable and hands Chez an fd plus an offset region, so the images are consumed with lseek/read on that fd. Chez's unbuffered fasl path reads code objects straight into the space_code segments it allocates for them, and those segments are recycled across the three boot files.

Under SMCChecks=mtrack FEX write-protects a guest page once it has translated code from it and relies on SIGSEGV to invalidate and unprotect. A host kernel write into guest memory cannot raise that signal, so the kernel reports EFAULT instead and Chez sees a short boot image.

Start by tracing SMCChecks=mtrack handling around its SIGSEGV-based invalidation and the read-like syscall path described in the report. Reproduce the failure with the Racket command shown and verify that Chez can consume all three boot images without a short read or EFAULT.

Written by the indexing model from the issue text.