Scope TU span checks to text sections

[andrewboudreau]

Re-cut of #2109 as requested in review: one commit directly on current main, with no unrelated stack ancestry.

span_entries now selects candidate contributions by .text only, so a neighbouring intact TU with later .data cannot make an adjacent text contribution look straddling. The existing fail-closed rule is retained: if a selected legacy entry itself owns non-text storage, promotion is still refused.

Validation: python -m pytest tools/test_tubuild.py -q (56 passed), Python compile check, port references 405/405, no new unresolved references, duplicate-source and shadow-TU pre-push gates green.

[tangos-validator]

✅ PR validation — Passed

noverify: no source/build-data changes in this PR

_{Each changed src/*.c|*.cpp is compiled and its relocated bytes compared to the binary data on a private build box. Passing requires every changed file to reproduce the ROM byte-for-byte with correct relocation targets — this catches WRONG-DEST relocations and non-reproducing near-misses that ledger-scoped linkcheck skips.}