Closes #487 and #348. Two related GC bugs in vera/codegen/assembly.py
fixed in a single batch.

#487 — $alloc grows by 1 page regardless of need
================================================

Pre-fix: when heap_ptr + total > memory.size * 65536, $alloc called
memory.grow 1 unconditionally. A single allocation > ~64 KB past the
current memory boundary fell through to the bump-allocate and
trapped on out-of-bounds memory access.

Post-fix: compute pages_needed = ceil(((heap_ptr + total) -
memory.size * 65536) / 65536) and grow by that many pages.
Verified against the issue's reproducer: two 50K-element Array<Int>
(~800 KB total) now allocates cleanly.

#348 — GC worklist silent overflow
==================================

Pre-fix: 16 KiB / 4096-entry worklist; both push branches (Phase 2
seed and Phase 2b mark scan) silently dropped pushes when full,
leaving reachable objects unmarked, which the sweep phase then
freed — a real use-after-free hole for object graphs holding
more than ~4K reachable pointers.

Post-fix:
  - Worklist quadrupled to 64 KiB (16 384 entries) for ~4× headroom
  - Both push branches now `unreachable` on overflow rather than
    silently dropping. Any residual overflow is a clean WASM trap,
    not silent corruption.

Eliminating the trap entirely via iterative deepening or dynamic
worklist growth is tracked separately for follow-up.

Tests
=====

Two new test classes, 5 tests total:

TestLargeAllocGrow487:
  test_50k_int_array_alloc_succeeds (returns 50000, was: trap)
  test_single_large_alloc_smaller_than_old_limit (regression pin)

TestWorklistOverflow348:
  test_moderate_graph_with_gc_pressure (1000-element Array<Box>)
  test_worklist_size_quadrupled_in_wat (gc_heap_start = 81920)
  test_worklist_overflow_traps_in_wat (≥6 i32.ge_u in $gc_collect)

Two existing tests updated for the new heap base:
  test_heap_ptr_starts_after_strings (32773 → 81925)
  test_heap_ptr_zero_without_strings (32768 → 81920)

Test count: 3,689 → 3,694.

Surfaced #570
=============

Writing the natural runtime regression test for #348 (a 5000-element
Array<Box>) hit a separate pre-existing bug: array_map's per-element
gc_shadow_push isn't unwound between iterations, exhausting the
16 KiB / 4096-entry shadow stack at ~4000 elements. Filed as #570
and tracked in KNOWN_ISSUES.md for follow-up; the #348 runtime
regression is covered by a 1000-element graph (within the shadow
stack budget) plus structural WAT pins.

Co-Authored-By: Claude <noreply@anthropic.invalid>

All three inline findings on PR #571 were valid; applied as suggested.

Inline (3):

  1. tests/test_codegen.py 1661-1662 + 1674 — combined $heap_ptr
     assertion.  Pre-fix:
       assert "global $heap_ptr" in result.wat
       assert "i32.const 81925" in result.wat
     could both pass even if the i32.const 81925 came from somewhere
     else in the WAT (e.g. an unrelated future constant).  Post-fix:
     match the entire decl + initializer in one substring:
       '(global $heap_ptr (export "heap_ptr") (mut i32) (i32.const 81925))'
     Applied to both test_heap_ptr_starts_after_strings (81925) and
     test_heap_ptr_zero_without_strings (81920).

  2. tests/test_codegen.py 15140-15179 — added
     test_page_boundary_alloc_rounding to TestLargeAllocGrow487.
     Pins the (shortage + 65535) >> 16 ceiling math at the 64 KiB
     boundary against off-by-one regressions.  Three subcases:
       - 8192 i64s = 65536 bytes (exactly 1 page)
       - 8193 i64s = 65544 bytes (1 byte over → must round up to 2)
       - 16384 i64s = 131072 bytes (exactly 2 pages)
     Each allocates fresh and reads the last element to force the
     access to land in the new memory.

  3. tests/test_codegen.py 15291-15305 — replaced the coarse
     ge_u_count >= 6 check with an exact regex match for the full
     overflow-guard opcode sequence:
       local.get $wl_ptr
       local.get $wl_end
       i32.ge_u
       if
       unreachable
     The pre-fix shape (i32.lt_u + push) wouldn't match this
     pattern, so a regression where one or both push branches
     reverted to silent-drop would now fail the test cleanly.

Test count: 3,694 → 3,695 (1 new test in TestLargeAllocGrow487).
ruff S clean, mypy clean, full pytest passes.

Co-Authored-By: Claude <noreply@anthropic.invalid>

…ichment

Appended to the v0.0.131 HISTORY.md row:
  - heap base offset change (gc_heap_start 32,768 -> 81,920 bytes
    from the worklist resize) so test-suite expectations are clear
  - note that this PR surfaced #570 (array_map shadow-stack
    overflow at ~4,000 elements), tracked for follow-up

Existing #487 and #348 references kept; phrasing matches the
release-note style of adjacent rows.

Co-Authored-By: Claude <noreply@anthropic.invalid>