Investigate ARM native-image CI failure in CiSpecE2eTest (no fix committed — insufficient quota)

[Copilot]

native-image (ubuntu-24.04-arm, rontolisp-linux-arm64) was failing: the WASM leg of CiSpecE2eTest aborted with wasmtime exit 134 (unreachable trap), because geom:read-model on ci-model.obj raised cannot tell what format ci-model.obj is — geom::%model-format returned nil for a file the same run had just written.

This PR captures the investigation to date. No code change is included; the session ran out of quota before a fix could be implemented or verified.

Findings

• Reproduced the full ci-spec.yaml suite (1976 sub-tests, including the failing case) locally on x86_64 against wasmtime 48.0.1 (the same "latest" release the workflow installs) — it passed cleanly, including the geom-read-model-cross-backend case in isolation and as part of the concatenated program.
• The identical commit had passed the same ARM job ~4 hours before this failing run, with no relevant source changes in between.
• This points to non-determinism tied to the ARM runner or wasmtime's aarch64 backend (Cranelift codegen or WASI filesystem behavior), rather than a deterministic bug in the Lisp source (geom.lisp's %model-format/%head-bytes/%first-token) or the WASM codegen.
• Was in the process of building an aarch64 wasmtime binary runnable under qemu-aarch64-static (using an Alpine musl sysroot) to attempt a direct repro on emulated ARM, but did not get to run it.

Next steps

• Finish the qemu-based aarch64 repro attempt to confirm whether this is wasmtime/Cranelift-specific or CI-infra flakiness (resource contention, runner filesystem quirks).
• If confirmed as an upstream/environment issue rather than an application bug, consider pinning wasmtime to a known-good version instead of "latest" in .github/workflows/ci.yaml, and/or adding retry to the ARM Verify native image step.
• If a genuine WASM-backend bug is found, target geom::%head-bytes/_read_packed (WASM) and the file I/O paths exercised by geom-read-model-cross-backend.