Add an RV64 freestanding startup contract and QEMU system smoke

## Roadmap context

Wave can emit and link RV64 freestanding artifacts, but it does not yet provide a complete startup and termination contract that can boot under `qemu-system-riscv64`.

## Scope

- Define the freestanding entry and output-image contract.
- Provide or explicitly require `_start`.
- Define stack pointer and global pointer initialization responsibilities.
- Decide BSS zeroing and data initialization behavior.
- Call `main` and handle its return value.
- Define a deterministic success/failure signal for QEMU.
- Decide whether Wave ships a default linker script and support an explicit override.
- Reject implicit hosted libc/printf dependencies.
- Add timeout-protected QEMU system execution in CI.

## Completion criteria

- [ ] A minimal image boots on a pinned QEMU virt machine.
- [ ] The smoke program emits a deterministic success signal.
- [ ] Stack alignment and relocation/code-model assumptions are tested.
- [ ] A hosted dependency in a freestanding build produces a frontend/driver diagnostic.
- [ ] CI kills a hung guest and reports useful logs.

This is a tracking implementation issue rather than a good first issue.

Start by tracing the existing RV64 freestanding artifact and linking support, then review how CI can invoke qemu-system-riscv64 on a pinned virt machine. Define the startup, memory initialization, termination, linker, and hosted-dependency contracts before implementing them. Done means the smoke image boots, signals success deterministically, validates alignment and relocation assumptions, diagnoses hosted dependencies, and times out with useful logs.

Written by the indexing model from the issue text.