P5.2b: link() build-pipeline action on the VM via a host vtable

The one genuine action primitive: link(objects, output, libraries, frameworks,
flags, target) in library/modules/std/build.sx. Per the user decision to drop
fallibility from the build callback, link is plain VOID — a link failure bails
on the VM (hard build error), no -> ! / failable-tuple needed.

comptime_vm.zig can't depend on the driver (core/main/target), so link
dispatches through a new compiler_hooks.BuildHooks { ctx, link } vtable that
main.zig installs into BuildConfig.build_hooks before the post-link callback.
The driver side is main.LinkHooksCtx (unions explicit + CLI link flags, calls
target.link). New VM readers readStringList / readStringArg (inverse of
makeStringList) decode the List(string)/string args from flat memory.

Smoke test examples/1663-platform-build-pipeline-link (AOT): a post-link
callback re-links the build's own objects (c_object_paths + emit_object) into a
temp output via sx link — the relinked binary is a functional executable that
runs. Negative-probe verified (bad path -> ld fails -> ComptimeVmBail -> build
exit 1). The Zig driver still auto-links; removing that is P5.4.

704/0 both gates.

src/ir/compiler_hooks.zig

@@ -72,6 +72,13 @@ pub const BuildConfig = struct {
     /// (the compiler emits the object eagerly; the primitive returns its path).
     object_path: ?[]const u8 = null,
 
+    /// Host-installed callbacks for build-pipeline ACTIONS the comptime VM can't
+    /// perform itself (it can't depend on the driver — `core`/`main`/`target`).
+    /// main.zig installs this before the post-link callback; the VM's `link`
+    /// primitive dispatches through it. Null outside a post-link build (a `link`
+    /// call then bails loudly — it's a post-codegen-only action).
+    build_hooks: ?*const BuildHooks = null,
+
     /// Frameworks the binary links against (`-framework` names) and
     /// the search paths to look them up in (`-F` directories), forwarded
     /// from the link step so the sx bundler can embed them into
@@ -106,6 +113,28 @@ pub const BuildConfig = struct {
     }
 };
 
+/// Host-installed callbacks for build-pipeline ACTIONS the comptime VM dispatches
+/// but can't perform itself (it must not depend on the driver: `core`/`main`/
+/// `target`). main.zig builds the concrete `ctx` + functions and points
+/// `BuildConfig.build_hooks` at it before invoking the post-link callback. The
+/// build callback is NOT fallible (Phase 5 decision) — a failed action returns an
+/// error here and the VM surfaces it as a hard build error.
+pub const BuildHooks = struct {
+    ctx: *anyopaque,
+    /// Link `objects` → `output`, with the given `libraries` / `frameworks` /
+    /// link `flags` / `target` triple. (`objects` is the full object list; the
+    /// adapter splits it for the underlying linker.)
+    link: *const fn (
+        ctx: *anyopaque,
+        objects: []const []const u8,
+        output: []const u8,
+        libraries: []const []const u8,
+        frameworks: []const []const u8,
+        flags: []const []const u8,
+        target: []const u8,
+    ) anyerror!void,
+};
+
 // ── Hook system ─────────────────────────────────────────────────────────
 
 pub const HookError = error{