t27b: JIT and interpreter disagree on gen_canvas.t27 since #7425 (lab mismatch 1 on master) #7550

The t27b lab has shown mismatch 1 and jit_interp_mismatch 1 on master since #7425 ("frames over 16 KiB, probing the stack one page at a time", Closes #7367). Before that it was 0.

• 7959d8b (before t27b: frames over 16 KiB, probing the stack one page at a time (Closes #7367) #7425): specs/port/trinity/src/tri/gen_canvas.t27 is codegen and blocked on FnDecl(frame size): "fn Canvas_init: 40032 bytes of local aggregates; at most 16384 per frame". https://t27b-lab-production.up.railway.app/runs/7959d8b3e86ff7f060608dbd7660c302d40b08f9.json
• 4ea8b26 (t27b: frames over 16 KiB, probing the stack one page at a time (Closes #7367) #7425): the same file is mismatch. https://t27b-lab-production.up.railway.app/runs/4ea8b2642a8a7327f20eb2730c2314d58c1f2a48.json
• 78c060f (master now): unchanged. https://t27b-lab-production.up.railway.app/runs/78c060f06b6cdc1b856696de8881f6cc53e34515.json

The detail is the same in every run:

MISMATCH Canvas_init_basic: jit Ok(365116131360), interpreter Err(Fault("1-byte access at stack+0x21 is outside every live slot"))

The reference passes all 5 tests, and so does the JIT. The interpreter faults on a byte access inside the 40 KiB frame. So the interpreter's live-slot model does not yet cover what the probed large frame lays out, or the probe itself touches stack bytes the interpreter does not track. Either way, the lab's mismatch 0 invariant is broken on master.

Found while proving the Mach-O port (#7526 / #7537) changes nothing: head and base both carry this one mismatch, file for file.

Refs #7367 #6063