feat: U3 @sealed optional segment marking - phase 2 complete

- UTSM_SEG_F_UNSEALED: plaintext direct-store segments (zero crypto overhead) while keeping capability checks, dirty tracking, intent/commit log and seqlock protocol; default remains sealed
- linker.ld: .sealed output section with __sealed_start/__sealed_end symbols for future static sealed data
- selftest: unsealed segment stores plaintext verifiably + read-back, full SELFTEST PASS (.build_tmp/qemu_serial_u3sealed.log)
- phase 2 (UTSM/UTRW) now complete in ROADMAP_INSANE

CODE/UTSM/linker.ld

@@ -27,6 +27,16 @@ SECTIONS
         *(COMMON)
     } :data
 
+    /* U3: @sealed 段标记 —— 用户代码可把静态数据放进 .sealed section
+     *（__attribute__((section(".sealed")))），UTSM 侧可遍历
+     * [__sealed_start, __sealed_end) 对该区建立封缄段。未标记数据 0 开销。 */
+    .sealed : ALIGN(4K) {
+        __sealed_start = .;
+        *(.sealed)
+        *(.sealed.*)
+        __sealed_end = .;
+    } :data
+
     .bss : ALIGN(4K) {
         *(.bss*)
     } :data