feat(relinker): --to-intel lowers SSE4a sites to same-length jumps into an appended stub section

EXTRQ, INSERTQ, MOVNTSS and MOVNTSD are rewritten at relink time: same-length in-place forms
where they exist, otherwise a jmp rel32 into an appended executable section holding a
scratch-free SSE body and a jump back, so no code shifts and no RIP-relative or jump-table
operand needs adjusting. Decoder fixes for POPCNT and 0F BB (BTC), codegen and elfpatcher
tests, README and technical-debt notes. The runtime illegal-instruction trap stays as a
fallback.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0177gthrWEBBfBu5xJDXgBfo

core/relinker/codegen/src/InstructionScanner.cpp

@@ -1,7 +1,9 @@
 #include <codegen/IInstructionScanner.hpp>
+#include <codegen/CodegenException.hpp>
 #include <codegen/x86/X64InstructionDecoder.hpp>
 #include <algorithm>
 #include <memory>
+#include <string>
 
 namespace Codegen {
 
@@ -29,7 +31,12 @@ std::vector<InstructionMatch> InstructionScanner::ScanCodeSection(
         const std::uint8_t* cursor = codeSection.data() + i;
         const std::size_t available = limit - i;
 
-        const std::size_t length = decoder.Decode(cursor, available);
+        std::size_t length = 0;
+        try {
+            length = decoder.Decode(cursor, available);
+        } catch (const CodegenException& e) {
+            throw CodegenException(std::string("Cannot decode instruction: ") + e.what(), codeSectionOffset + i);
+        }
 
         matches.push_back({codeSectionOffset + i, length});