Runtime.NativeTelemetrySeal

SEALING AN ALPHATEL RECORD AT RUN TIME (docs/observability PRD item 9). Runtime.NativeTelemetry encodes a record as "ALPHATEL", the body, then the SHA-256 of the body in 64 lowercase hex characters. A record whose body carries a clock reading can only be sealed where the reading is taken, so this routine does, in the executable, what the encoder does at build time for the rest of the body: rdi the body followed by its SHA-256 padding (0x80, zeros, the bit length), whole 64-byte blocks, in writable memory rsi the number of blocks rdx the record: "ALPHATEL" already at +0; the body is copied to +8 and the hex digest written after it rcx the body's length in bytes (nonzero) r8 a struct timespec (seconds, nanoseconds): its nanoseconds since the clock's epoch are written into the body at `sealMonotonicAt` first, so the digest covers them r9 a work area of `sealWorkBytes` bytes It keeps the System V callee-saved registers it uses in the work area (the instruction set has no push) and returns. Every 32-bit quantity is kept zero-extended in a 64-bit register and truncated by its 32-bit store; a rotation is a shift of the doubled word. The digest is checked against the build-time encoder's by reading a record the executable wrote (scripts/ci/observability.sh: `alpha observe import alphatel` verifies every record's digest).

36def sealImm32 = x86NativeImmediate32FromNatural