[moloch--]

Summary

• Merge packed ELF RELR support from Support ELF packed RELR in custom loaders #13 and the IFUNC/IRELATIVE safety guard from Reject unsupported ELF IFUNC resolvers safely #23 on top of Support local C ELF TLS on Linux amd64 custom loaders #30 (which includes Reject unsupported general ELF TLS in all custom loaders #18).
• Resolve root, native, recursive, README, and Linux CI conflicts while preserving the Linux/amd64 local dynamic TLS scope and explicit unsupported TLS rejection.
• Keep defined GNU IFUNC rejection before custom-image mapping and IRELATIVE rejection in root, native, and recursive ELF loaders. No custom IFUNC execution is enabled.

Local verification

Pinned Linux/amd64 Docker image: Go 1.26.6, Zig 0.14.0, GCC 12.2.

• CGO_ENABLED=1 targeted integration fixtures passed: RELR root/native/recursive, local dynamic TLS root/native/recursive, initial-exec and external TLS rejection, and IFUNC/IRELATIVE rejection across all three loader paths.
• CGO_ENABLED=0 targeted integration fixtures passed: RELR root/native/recursive, general TLS registration rejection, and IFUNC/IRELATIVE rejection across all three loader paths.
• go test ./memmod ./native/internal/linuxmem ./internal/elfrelr ./internal/elftls -count=1 passed with both CGO modes.
• Cross-compiled the integration test binary with CGO_ENABLED=0 for Linux ARMv7, 386, arm64, ppc64le, riscv64, and FreeBSD amd64/arm64 (with the documented PureGo fake-CGO flag).

This is a stacked integration PR targeting #30. The source PR branches remain unchanged.