Enable strict Android W^X for Frida 17.16.4 releases

[TheQmaks]

Summary

• add an explicit --strict-wx mode for Frida-owned Android mappings
• split injector code, loader data, and the 64 KiB loader stack into RX/RW regions
• finalize newly generated Gum, Java-bridge, and NativeCallback code as RX while keeping mutable storage RW
• enable and attest strict W^X for official Frida 17.16.4 releases
• gate Server and Gadget acceptance on zero anonymous RWX mappings
• exercise NativeCallback, Interceptor, Stalker, and Java paths on a rooted Android device

Root cause and fix

Physical-device snapshots isolated persistent anonymous RWX mappings in three paths: the Frida Core bootstrap allocation, Gum/Java bridge code finalization, and libffi closure storage used by NativeCallback.

The patch preserves the upstream bootstrap ABI while applying staged host-side protection changes, restores generated code to RX, and copies immutable NativeCallback closure code into a dedicated RX page while retaining libffi's writable metadata in RW memory. Protection failures fail closed and clean up allocations. Explicit user-script requests for RWX remain explicit and are not rewritten.

Validation

• 156 pytest tests pass with coverage
• Ruff check and formatting, mypy, Node syntax, Bash syntax, actionlint, and git diff --check pass
• exact-source patch probe passes against Frida Core 0e1a53ba7ab7615e6c8cc0cf1ee4fc45ab7d0722 and Frida Gum 7eddbb15847ac18c15d21ae1cff48103acd944d5
• exact GitHub Actions build for commit 509e00a9a68f1427e06596d2ec96f44e5082d386 succeeded: run 30078412111
• every downloaded artifact matches SHA256SUMS; build metadata records Frida 17.16.4, android-arm64, extended patches, and strict W^X
• rooted LineageOS 21 / Android 14 (API 34), arm64 physical-device acceptance passed for both Server and Gadget
• Server anonymous RWX mappings: 0
• Gadget anonymous RWX mappings: 0
• direct NativeCallback invocation plus Interceptor, Stalker, and Java runtime checks passed
• CI and both CodeQL language analyses pass

Android 15 issue #5 remains open until the reporter can retest the resulting release on Android 15.