runtime: tighten recover to direct deferred calls

[cpunion]

Summary

Fix recover/defer ownership during panic unwinding.

recover now only succeeds from the deferred function that is actually being run, while panics rethrown through nested defer and range-over-func frames remain recoverable by the correct outer defer.

Examples covered by this PR:

// A directly deferred function value can recover the panic.
defer func() {
	if recover() == nil {
		panic("not recovered")
	}
}()
panic("boom")

// A nested defer inside a deferred function must not recover the outer panic.
defer func() {
	defer func() {
		if recover() != nil {
			panic("nested recover should be nil")
		}
	}()
	if recover() != "outer" {
		panic("outer recover failed")
	}
}()
panic("outer")

// A panic crossing range-over-func/defer frames remains recoverable by the
// correct deferred function, instead of being claimed by an inner frame.
defer func() {
	if recover() != "loop panic" {
		panic("recover owner mismatch")
	}
}()
for range func(yield func(int) bool) {
	defer func() { _ = recover() }()
	yield(1)
} {
	panic("loop panic")
}

Main verification

After #1950 was merged, latest xgo-dev/llgo main still fails the nested defer/recover case above. The temporary LLGo test failed with:

outer recover = <nil>, want outer

The same case passes with go test, so this PR still covers a remaining LLGo recover/defer ownership bug.

[codecov-commenter]

Codecov Report

❌ Patch coverage is 42.60953% with 1192 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
benchmark/runtime_funcinfo/main.go	0.00%	672 Missing ⚠️
internal/pclnpost/binary.go	12.91%	181 Missing and 1 partial ⚠️
internal/pclnpost/write.go	0.00%	150 Missing ⚠️
internal/pclnpost/fixups.go	0.00%	125 Missing ⚠️
internal/pclnpost/pclnpost.go	0.00%	22 Missing ⚠️
internal/pclntab/pclntab.go	61.40%	11 Missing and 11 partials ⚠️
cl/instr.go	96.77%	11 Missing and 6 partials ⚠️
cl/compile.go	98.83%	1 Missing and 1 partial ⚠️

📢 Thoughts on this report? Let us know!

[cpunion]

Added patch-coverage tests for the recover/direct-deferred-call helpers:

• ssa/ssa_test.go: covers recover defer token classification for marked function decls, function pointers, non-function values, nil expressions, and the recover builtin helper.
• cl/cgo_test.go: covers functionUsesRecover nil/direct-recover cases and callMayRecover conservative closure/default paths.

Local verification:

• go test ./ssa -coverprofile=/tmp/llgo-recover-ssa-full-after.out (passes; ssa/eh.go recover helper functions now report 100% for callRecoverScopedDefer, recoverDeferToken, deferMayRecover, and isRecoverBuiltin)
• go test ./cl -run 'Test(RecoverCallClassificationHelpers|EmitDo|CompileRangeFuncDeferModule|DeferStackOwner|RangeFuncDefer|NestedRangeFunc|Cgo)' -coverprofile=/tmp/llgo-recover-cl-after2.out (passes; functionUsesRecover and callMayRecover report 100%)
• go test ./test/go -run TestRecoverFixedbug -count=1 (passes)
• go run ./cmd/llgo test -run TestRecoverFixedbug -count=1 ./test/go/recover_defer_fixedbugs_test.go (passes)
• git diff --check (passes)

Note: go run ./cmd/llgo test -run TestRecoverFixedbug -count=1 ./test/go still links the whole test/go package and failed before reaching the recover tests due unrelated generic-local-type undefined symbols, so I used the single recover test file for the focused LLGo runtime/codegen check.

[cpunion]

Rebased onto #2016 (codex/pclntab-linkphase-p1, which includes #2012) per the review-order plan: #2012 → #2016 → this line of semantics fixes. Conflicts resolved were additive (context fields, the noinline condition set, and runtime.Panic now calls SavePanicCallerFrames() before the panic-node bookkeeping). Note the PR base is still main, so the diff shows #2012/#2016 commits until those merge.

[cpunion]

Superseded by #2033, which re-expresses the Defer-node recover-ownership model on the stage-5 base (#2023); the funcinfo draft carried here was superseded by #2012/#2016/#2019. #1882's recover-error-value work re-expresses on top of #2033 next.