chore(evm-polkavm): align polkavm to 0.33.1 and enforce the sbrk-free ISA

[nol4lej]

Why

frame/evm-polkavm pinned polkavm 0.29.1 while the SDK 2606 executor (sc-executor-polkavm 0.44.0) runs 0.33.1, so Cargo.lock carried both copies in one binary. Registered as debt during the 2606 migration; this clears it.

What changed

Aligned to 0.33.1. Four duplicate crates dropped from the lockfile (polkavm, -assembler, -common, -linux-raw at 0.29), none added. polkavm-derive in uapi went 0.30.0 → 0.33.0 to match.

The sbrk guarantee moved, so it is now enforced where code enters the chain. ModuleConfig::set_allow_sbrk(false) is gone in 0.33, the blob's own InstructionSetKind decides whether the opcode decodes, and polkavm-linker takes the
ISA as a required argument, so it is chosen by whoever compiled the contract. The pallet cannot assume it, so create_polkavm now validates:

ISA	carries sbrk?	accepted
ReviveV1, JamV1	no	yes
Latest32, Latest64	yes (opcode 101)	no

A whitelist, not a blocklist: a future ISA is rejected until someone checks it. Memory growth changes gas consumption and this is consensus code.

Three slice panics fixed. AccountCodes::get returns an empty Vec for any address without contract code, and both execute and is_precompile indexed it with code[0..8], so a call to a plain account panicked. create_polkavm had the same shape (its length check is an upper bound only).

The riscv64 guest ABI now compiles. uapi/src/host/riscv64.rs failed with two E0432 errors: five imports pointing at paths that do not exist in this crate, plus pallet_revive_proc_macro, which was never a dependency. None of them were used, all served host functions this crate does not declare. Broken since the upstream commit that introduced it, unnoticed because nothing built for that target.

A CI step that builds it, with the target installed in the job rather than in rust-toolchain.toml, so a normal build does not pay for a ~100 MB std nobody else needs.

Testing

• 4 unit tests (the crate had none), mutation-tested: accepting Latest32 fails,
  breaking the fixture's ISA mapping fails, restoring code[0..8] fails
• cargo check for the pallet, the benchmarking feature, and the whole workspace
• cargo build -p pallet-evm-polkavm-uapi --target riscv64imac-unknown-none-elf --release
  — 466 KB rlib carrying the ABI symbols
• cargo fmt, clippy --all-targets

Note

The pallet is still not wired into any runtime, no construct_runtime! entry, nothing outside the crate depends on it. This makes it sound, not live. A follow-up would need runtime wiring, a contract toolchain, and end-to-end execution tests.

The three bug fixes were sent upstream as polkadot-evm/frontier#1923; the version bump and the ISA policy stayed here, since the policy is ours to choose.