A stale ELF patch plan can rewrite a newer fixed-address mapping

A potential issue found by [Specula](https://github.com/specula-org/Specula):

See the full [report](https://github.com/specula-org/specula-case-studies/blob/data/litebox-case-study-20260831/systems/litebox/modules/core/runs/litebox-known-aware-rerun-20260830/confirmed-bugs.md#entry-6-a-stale-elf-patch-plan-can-rewrite-a-newer-fixed-address-mapping) for more details.

## Trigger scenario
1. Map a read-only file-backed ELF page, creating ElfPatchState.file_mappings.
2. Replace the same address with a different read-only file using mmap(MAP_FIXED).
3. Call mprotect(addr, len, PROT_READ|PROT_EXEC).
4. maybe_patch_on_mprotect_exec collects the stale old mapping and maybe_patch_exec_segment rewrites the bytes currently at that address, which now belong to the replacement mapping.

Though benign programs should not do this, we should probably still fix it.