feat(C2): unit-first JIT symbol resolution — program-owned dylibs beat process images

runJITFromObject now takes priority dylibs (the #import c unit's
linked objects first, then #library deps in declaration order) and
attaches a per-path search generator for each AHEAD of the
process-wide fallback, so a vendored symbol can never lose to a
same-named export of an image the host process happens to carry
(libz via LLVM, libsqlite3 via CoreServices). loadLibrary reports
the name dlopen succeeded on; the c-import handle records its dylib
path; temp link inputs are per-pid so concurrent runs can't clobber
each other. Flips the C0.3 shadowing pin to from_unit: true.

examples/1621-cimport-shadow-os-lib.sx

@@ -1,9 +1,10 @@
-// Pins the C2 gap (PLAN-C C0.3): a `#source` unit defining a symbol
-// that ALSO lives in an OS image already loaded into the compiler
-// process (libz, via libLLVM) loses under `sx run` — the JIT resolves
-// globally and the earlier-loaded OS copy wins. The unit's
-// zlibCompileFlags answers 0xDEADBEEF (3735928559); the OS one answers
-// real flag bits. After C2 (unit-first resolution) this prints true.
+// Unit-first JIT resolution (PLAN-C C2): a `#source` unit defining a
+// symbol that ALSO lives in an OS image already loaded into the
+// compiler process (libz, via libLLVM) still wins — the unit's dylib
+// is a priority symbol-search target ahead of the process-wide
+// fallback. The unit's zlibCompileFlags answers 0xDEADBEEF; the OS
+// one answers real flag bits, so `true` proves the unit won.
+// Regression (PLAN-C C0.3 xfail, flipped by C2.1).
 #import "modules/std.sx";
 
 zshadow :: #import c {

examples/expected/1621-cimport-shadow-os-lib.stdout

@@ -1 +1 @@
-from_unit: false
+from_unit: true