feat: add the universal build (goffi_universal, "Profile U")

[unxed]

Step 4 of the split agreed in #76. Depends on #87 (goffi_musl). The branch is stacked on it, so review only the last commit.

-tags goffi_universal builds one CGO_ENABLED=0 binary for linux/amd64 and linux/arm64 that does FFI on both glibc and musl hosts.

How it works

• Every libc import has an empty SONAME, so the binary has no DT_NEEDED. scripts/build-universal.sh then removes PT_INTERP, and cmd/goffi-audit checks both. The kernel can load the binary directly on any distro.
• At the top of x_cgo_init, before any libc symbol is used, the process re-execs itself through the host's dynamic loader with the host libc preloaded. On glibc it also preloads libpthread.so.0 and libdl.so.2, which older glibc needs. glibc's loader only binds a main object that has PT_INTERP, so on glibc it gets an in-memory copy with that header restored. This code uses only raw syscalls and mmap'd scratch memory.
• Fallback. If there is no loader goffi recognises, or a library preloaded through LD_PRELOAD or /etc/ld.so.preload kills the re-executed process, the program keeps running as pure Go. LoadLibrary, GetSymbol and CallFunction then return ffi.ErrNoHostLibc. When something is preloaded, the launch is first tried in a forked child.

The exec.Command question from #76. I removed the footgun instead of wrapping it:

• The re-exec guard GOFFI_UNIVERSAL_REEXEC is now <pid>:1, tagged the same way as GOFFI_UNIVERSAL_EXE and GOFFI_UNIVERSAL_ARGV0. The re-executed process keeps its pid, so it finds its own guard. A child has a new pid, so it runs the bridge itself.
• cmd/universal-respawn starts itself via os.Args[0], via ffi.Executable(), and as a grandchild. Each child must call getpid and strlen through goffi and report the on-disk ffi.Executable().
• CI runs it on the runner, on four glibc images (glibc 2.31 to current) and on Alpine. All pass.
• It also tries starting the copy through the host loader by hand. That is reported but not required: glibc 2.31's loader rejects a /proc/self/fd/<n> image with loader cannot load itself. With the pid-tagged guard, that recipe is no longer needed anyway.

ffi.Available(). The godoc now spells out the three modes:

• constant false under goffi_static;
• decided once at startup under goffi_universal;
• true otherwise.

This PR adds Available to upstream, along with:

• ErrNoHostLibc;
• HostLoader, HostLibC, HostPreload and LibcKind (from internal/loader);
• Executable and Argv0, which return what os.Executable() and os.Args[0] gave before the re-exec.

Tags: goffi_static takes precedence over goffi_universal. Under goffi_universal, the glibc and goffi_musl import files are excluded.

CI: new universal.yml. It builds every mode, then runs vet and tests. It builds one probe binary and runs that same binary on glibc and musl, runs the respawn probe everywhere, and runs the preload-abort fallback jobs. Everything passes. In ci.yml only the Android arm64 jobs fail, in "Set up Android SDK", which #85 fixes.

Docs: docs/PROFILE_U.md, README, CHANGELOG, NOTICE (attribution to unxed/static-everywhere).

🤖 Generated with Claude Code

[codecov]

Codecov Report

❌ Patch coverage is 78.57143% with 9 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
ffi/selfinfo.go	73.52%	5 Missing and 4 partials ⚠️

📢 Thoughts on this report? Let us know!