Verify intact TUs with non-text sections

[andrewboudreau]

Summary

• extend intact-TU verification and production admission to .init, .ctor, .data, and NOBITS .bss ownership
• add exact, fail-closed policies for undefined-symbol aliases and compiler-local symbol bindings
• compare already-enrolled intact candidates against a fresh source-independent strict control
• cover the new paths and replace one promotion-sensitive test fixture with a stable synthetic fixture

This is the tooling-only base for the stacked ov023 complete-overlay promotion.

Validation

• python -m pytest tools/test_tubuild.py -q — 66 passed
• python -m unittest tools.test_rombuild_check tools.test_rombuild tools.test_tu_production tools.test_objisolate — 106 passed
• python tools/rombuild.py -j 16 --no-rom — 11,088/11,088 functions and 106/106 modules exact
• pre-push gates — 405/405 port references and 98/98 reconstructed TUs compile

[tangos-validator]

✅ PR validation — Passed

noverify: no source/build-data changes in this PR

_{Each changed src/*.c|*.cpp is compiled and its relocated bytes compared to the binary data on a private build box. Passing requires every changed file to reproduce the ROM byte-for-byte with correct relocation targets — this catches WRONG-DEST relocations and non-reproducing near-misses that ledger-scoped linkcheck skips.}