v0.39.1 — multi-provider shadow-stack co-rebase (#707)

A single-fix release that unblocks the gust:os multi-provider OS node — the last synth gate before gust:os v0.4.0.

Fixed

• --shadow-stack-size co-rebases N aliased __stack_pointer globals (#707, VCR-MEM-001). After #701 cleared the buffer-carrying blocker (#678 tail down-shift), a multi-provider meld fuse --memory shared node (app + time-provider + log-provider) compiled all functions but the shadow-stack shrink then refused: the fused shared-memory module carries one __stack_pointer global per fused component, all with init == sp_init, and the re-base insisted on a unique match.

  These globals alias the one shared reservation, so the fix re-bases the whole mutable-global init == sp_init equivalence class to the shrunk budget. An immutable constant that merely coincides with sp_init is never touched (same predicate identify_stack_pointer_global selects on). A single-SP module has exactly one match ⇒ byte-identical (the #383/#678 paths are unchanged); only "no mutable global carries sp_init" stays an honest refuse.

  Falsification: compile a 3-__stack_pointer node with --shadow-stack-size B — all three mutable SP slots must re-base to B while an immutable constant equal to sp_init stays put; each function's shadow-stack roundtrip returns its input and restores its own slot to B. Gated by multi_sp_rebase_707.rs + the execution differential multi_sp_707_differential.py.

  Lineage: #383 (layer-1 shrink) → #678/#701 (layer-2 tail down-shift) → #707 (multi-SP co-rebase). VCR-MEM-001, epic #242.

Housekeeping

• npm wrapper version swept 0.38.0 → 0.39.1 (it was stale from #703's post-hub merge — the npm package version is the GitHub-release tag it downloads).

Gates: claim-check 17/17, frozen anchors 10/10, clippy/fmt clean.