TRI-27 emulator: CALL pushes its own address, so every CALL/RET pair loops until the instruction budget

[dmitrii-f-t27]

Where: executor.zig at 976df51.

What happens. CALL pushes the address of the CALL itself: pc is not advanced before the push. RET then returns to that CALL, which calls again.

• Every CALL/RET pair is an endless loop, with sp alternating between two values.
• Only the instruction budget stops it.
• No subroutine can return past its call site.
• No owner test executes a CALL.

Source: specs/isa/tri27_machine.t27, FINDINGS.

Expected. CALL pushes the address of the instruction after it, so RET resumes after the call.

Vector. call-never-returns in conformance/trinity/tri27_programs.json. sp alternates between 4 and 8, and the budget stops the run after 33,333 rounds.

Found while writing the S05 specs of #988 (gHashTag/t27#3581); until now it lived only in the spec's FINDINGS. The vectors are replayed by tools/trinity_tri27.py in gHashTag/t27. Tracked in #1164.