layout: --stack-layout=low — stack at SRAM bottom growing into reserved space, so overflow BusFaults instead of corrupting linmem/globals (VCR-MEM lineage)

[avrabe]

Design (from maintainer discussion 2026-07-10): today's self-contained image sets SP at the top of SRAM growing DOWN toward the globals table (R9) and linear memory — stack overflow silently corrupts them. Graded fix menu:

1. --stack-layout=low (this issue, first increment): SP init = SRAM_start + stack_size, linmem/globals ABOVE the stack. Overflow descends past 0x2000_0000 into reserved/flash-alias space → precise BusFault on the first errant push, every Cortex-M, NO MPU. Flag-gated (moves the linmem base — the 0x20000100 harness contract and R9/R11 conventions pin the current default), frozen-safe by default-unchanged.
2. MPU guard region below the stack (reuse --safety-bounds mpu machinery) — works with stack-high, costs one v7-M region.
3. PSPLIM/MSPLIM on ARMv8-M targets (M33/M55) — hardware limit, wire when v8-M matters.

Relates: #404/#406 (MPU-protectable region model), VCR-MEM-001/002. Acceptance: fixture with deliberate stack overflow — stack-high silently corrupts a canary in linmem (red evidence), stack-low BusFaults before touching it (green); in-budget programs byte-identical modulo the two startup constants; frozen anchors untouched (flag off).