Document hosted and freestanding RV64 workflows

## Problem

Wave's README lists RV64 targets and automatic sysroot discovery, but contributors and users still need a focused guide that distinguishes hosted Linux execution from freestanding output.

## Scope

Document:

- `riscv64-unknown-linux-gnu` defaults: RV64GC and LP64D.
- `riscv64-unknown-none-elf` defaults and freestanding limitations.
- Required cross GCC, binutils, sysroot, LLD, and QEMU tools.
- Automatic sysroot discovery and explicit `--sysroot` precedence.
- `target-list`, `target-spec`, and dry-run inspection.
- Building and executing a hosted binary with qemu-user.
- Current freestanding output and the work tracked by its runtime issue.
- Unsupported RV32, musl, vector V, big-endian, and embedded ABI scope.

## Completion criteria

- [ ] Every command is tested on a supported Linux development host.
- [ ] Current support is not overstated.
- [ ] README links to the focused guide.
- [ ] Hosted and freestanding support levels are visibly distinct.

Start with the README sections covering RV64 targets and automatic sysroot discovery, then verify the required cross-toolchain, sysroot, LLD, and qemu-user commands on a supported Linux host. Create the focused guide, link it from the README, document hosted and freestanding support separately, and ensure every command and limitation matches current behavior and the runtime issue.

Written by the indexing model from the issue text.