Harden 10 differential oracles: read symbols from ELF .symtab, not disasm text (host-dependency)

[avrabe]

The rv32 memory.size/grow oracle failed 100% on CI (no symbol for export sz ([])) because it located function offsets by regex-parsing synth disasm TEXT,
which matched nothing on the Linux runner for a --relocatable RISC-V object
(worked on macOS). Fixed in fa9958c by reading the ELF .symtab via pyelftools.

The same host-fragile pattern remains in 10 other repro oracles (they pass on CI
today but carry the latent dependency):

• add_imm_large_differential.py
• bulk_memory_374_differential.py
• bulk_mask_679_differential.py
• bulk_local_clobber_677_differential.py
• control_step_riscv_differential.py
• div_const_differential.py
• controller_step_riscv_differential.py
• i64_large_offset_382_differential.py
• load_store_big_offset_382_differential.py
• signed_div_const_riscv_differential.py
• uxth_fold_differential.py

Harden each to resolve symbols from .symtab (st_value), matching the
differential-harness symtab convention. Non-blocking (they're green now); do it
before they bite the way #841's oracle did.

[avrabe]

Shipped in v0.51.0 (#853): 9 differential oracles now read the ELF .symtab instead of host-dependent disasm text (each verified before==after). The host-dependency class that failed the rv32 memory oracle on Linux is closed for these; bulk_mask_679 + bulk_local_clobber_677 were already symtab-based.