Add operand-normalized semantic code signatures

New semsig_hash(mem_view_t) primitive (include/semsig.h): a position-,
register-, immediate- and instruction-order-invariant function fingerprint.
It folds per-instruction operand-canonical tokens, splitting the body into
basic blocks via cfg_blocks and using a within-block order-insensitive
sort-then-fold (between-block order preserved), so it survives compiler
register reallocation and instruction scheduling that the byte-mask
func_hash/sig_generate cannot. Distinct hash domain from func_hash.

The operand decode is delegated to an OPTIONAL external disassembler behind
a private adapter seam (src/handlers/semsig_backend.h); semsig.c stays
backend-neutral and includes no backend header. VMIE_DISASM={OFF|zydis|
capstone} gates the build: OFF (default) compiles only semsig_stub.c and
keeps the zero-dependency build (VMIE_HAVE_DISASM=0, packages unchanged).
The backend is brought from VMIE_DISASM_SRC or find_package - never
vendored. Adds the vmie_win32_func_semsig wrapper.

The CI deb job builds with the Zydis backend (libzydis-dev); the runtime
package dependency on libzydis is derived automatically by dpkg-shlibdeps.

src/handlers/semsig_stub.c

@@ -0,0 +1,26 @@
+/* semsig_stub.c - the OFF (no-backend) path of the semantic-signature feature.
+ *
+ * Built into the library ONLY when VMIE_DISASM=OFF (the default). It provides
+ * the full public generic surface so the ABI is stable - linking never fails
+ * for a missing symbol - while the feature is not present:
+ *   semsig_hash         -> 0  (the same "no hash" sentinel as func_hash)
+ *   semsig_backend_name -> "none"
+ * Callers tell "feature off" from "empty/undecodable function" via the compile-
+ * time macro VMIE_HAVE_DISASM (0 here), NOT via the runtime 0.
+ *
+ * In the OFF build semsig.c is NOT compiled (it calls the backend decode, which
+ * does not exist without a backend); this stub is the whole generic symbol. See
+ * CMakeLists.txt for the source-selection logic.
+ */
+#include <stdint.h>
+#include "semsig.h"
+
+uint64_t semsig_hash(mem_view_t fn) __attribute__((cold));
+uint64_t semsig_hash(mem_view_t fn) {
+    (void)fn;
+    return 0;   /* feature not built: same sentinel as func_hash */
+}
+
+const char* semsig_backend_name(void) {
+    return "none";
+}