…ue root (closes #570)

The lifted-closure epilogue in vera/codegen/closures.py restores its
entry $gc_sp and then, when the return type is a heap pointer (Vera
ADT, String, Array<T>), pushes the return as a fresh root so generic
stash-then-GC callers stay sound. The iterative array builders in
vera/wasm/calls_arrays.py consume the return synchronously (store
into a rooted dst[idx], or in-place overwrite a rooted accumulator
slot), so the per-call root is redundant. Accumulating one leaked
slot per iteration overflowed the 16 KiB / 4 096-entry shadow stack;
a 5 000-element array_map<_, ADT> trapped at iteration ~4 000.

Per-callsite unwind:

* array_map / array_mapi: emit a 4-byte $gc_sp decrement after
  storing the return into dst[idx].
* array_fold: emit the same unwind BEFORE the gc_sp - 8 overwrite
  math. Without it the second iteration overwrite addressed the
  previous-call leaked slot instead of the accumulator pre-call
  slot — a second symptom of the same bug class that this fix
  incidentally closes.
* array_sort_by: same 4-byte unwind after the comparator Ordering
  tag is read via i32.load offset=0. Insertion sort issues up to
  n*(n-1)/2 comparisons; the leak surfaces at ~200 reverse-sorted
  elements.

Builders that take a Bool-returning predicate (array_filter,
array_find, array_any, array_all) and builders without a callback
(array_flatten, array_reverse, array_range) are unaffected — Bool is
excluded from the closure ret_is_pointer flag, so no post-restore
root push happens.

New TestIterativeBuilderShadowStack (4 tests) in
tests/test_codegen_closures.py exercises each fixed builder at the
size that previously overflowed.

Co-Authored-By: Claude <noreply@anthropic.invalid>

…rom forward-looking files

ROADMAP had grown a 12-version retrospective paragraph in the
bug-killing-campaign intro plus historical residue scattered
through priority entries, the VeraBench section, Phase 3a/3b/4c
items, the CI table, and a duplicate Completed-Phases table that
restated HISTORY.md verbatim. None of this was forward-looking; it
was "what shipped two PRs ago" stuff that belongs in HISTORY (per-
release table) or CHANGELOG (long lists per version).

Changes:

* ROADMAP intro: drop the "Vera v0.0.132 delivers..." version peg
  (will go stale every release; not load-bearing).
* ROADMAP campaign paragraph: collapse 12 sentences of release
  retrospective to 2 — count of remaining issues + pointer to
  HISTORY/CHANGELOG.
* ROADMAP priority table: drop "splits out from #346 closed as
  superseded after v0.0.132 shipped..." and "phase 1 ... shipped
  in v0.0.117" framing; keep only what an agent picking up the
  issue needs to know.
* ROADMAP VeraBench section: replace per-rerun delta narrative
  with a high-variance disclaimer.
* ROADMAP Phase 3a/3b/4c entries: drop "during the v0.0.121 review
  cycle", "the v0.0.119 homepage redesign moved the score from
  3+2 to 2+1", "shipped in v0.0.117/v0.0.118" — keep current state
  only. CI table loses "the tag/release gap that hit v0.0.113".
* ROADMAP Completed Phases: replace 11-row table (which duplicated
  HISTORY.md Stages 1–9) with a one-liner pointing to HISTORY.

* KNOWN_ISSUES Bugs table: tightened all three entries. The #573
  entry was a 6-clause sentence with parenthetical-of-paren-
  thetical recapping the v0.0.132 host_gc_sweep design discussion;
  trimmed to symptom + recommended fix. #549 and #568 trimmed
  similarly.

* HISTORY by-the-numbers row: bump v0.0.132 column to v0.0.133
  (3,706 tests, 133 releases).

No content removed — anything trimmed from these three files is
either redundant with HISTORY/CHANGELOG or now lives in the
underlying GitHub issue body.

Co-Authored-By: Claude <noreply@anthropic.invalid>