Validate hosted AArch64 Linux cross-linking under QEMU

## Why

The native ARM64 CI job proves that Wave runs on an AArch64 host, but it does not validate the x86_64-to-`aarch64-unknown-linux-gnu` sysroot discovery and cross-link path. RISC-V already has this style of end-to-end contract.

## Scope

- On an x86_64 Ubuntu runner, install the AArch64 GNU cross compiler, libc sysroot, binutils, and qemu-user.
- Build Wave once with bounded parallelism.
- Compile and link a small Wave program for `aarch64-unknown-linux-gnu`.
- Validate ELF class/machine and interpreter metadata.
- Execute with `qemu-aarch64 -L `.
- Add one C ABI fixture invocation if the existing AAPCS64 fixture can be reused safely.

## Completion criteria

- [ ] Automatic and explicit AArch64 sysroot paths are tested.
- [ ] The binary is confirmed as AArch64 ELF64 before execution.
- [ ] QEMU output and exit status are asserted.
- [ ] Missing/incomplete sysroots have a negative regression.
- [ ] CI uses `--jobs 2` and a bounded timeout.

Locate the existing RISC-V end-to-end contract and the CI job for native ARM64, then inspect whether the existing AAPCS64 fixture can be reused. Run the current compiler and linker tests before adding the x86_64-to-AArch64 path. Done means automatic and explicit sysroots, ELF metadata, QEMU output and status, incomplete-sysroot failures, and bounded CI parallelism and timeout are covered.

Written by the indexing model from the issue text.