The four guest_arena tests still pass with the mach_vm_region walk
disabled, because TryReserve marks every 1 GiB chunk it cannot reserve
as occupied. guest_arena_gap reads the host map before the arena
reserves its range and requires a fixed guest mapping in free space
that shares a chunk with a host region to be accepted.
The debt entry also records that on macOS 27.0.1 (M4 Pro) the
unmappable range starts at 0xF_C000_0000.
macOS has no /proc/self/maps or MAP_FIXED_NOREPLACE, so the arena never came up and every guest allocation threw. Enumerate host regions with mach_vm_region and reserve free chunks with a fixed mach_vm_map, which fails instead of replacing. This skips dyld, the Rosetta runtime, and ranges the kernel never lets a process map (0x10_0000_0000-0x70_0000_0000). The POSIX commit/protection paths now build on macOS unchanged. Adds standalone guest_arena tests (x86_64 under Rosetta and arm64).