fix(build): mark Nomic ELF blob stack non-executable

[aaiyer]

What does this PR do?

The generated Nomic vector blob omitted the ELF .note.GNU-stack section. GNU ld therefore warned that the object implied an executable stack, and the linked binary exposed GNU_STACK RWE.

Fix

• add an empty, flagless .note.GNU-stack section only in the ELF branch of vendored/nomic/code_vectors_blob.S;
• update write_blob_s() so its generated output exactly reproduces the current cross-platform assembly wrapper plus the ELF-only note.

The generator update is required for this fix to survive regeneration. Before this patch the generator was stale and emitted only the Mach-O form, while the tracked generated artifact already contained Mach-O, COFF, and ELF branches.

Validation

• base reproduction: GNU ld warning and linked GNU_STACK RWE;
• fixed GCC and Clang objects: empty, flagless .note.GNU-stack;
• fixed linked binaries: GNU_STACK RW;
• GNU and Clang assembly accepted for x86-64 and AArch64;
• generated file: 1,334 bytes and byte-identical to the tracked artifact;
• Mach-O and COFF preprocessed branches: byte-unchanged;
• Python syntax, focused semantic tests 33/33, final production build, DCO, and git diff --check: passed;
• full scripts/test.sh printed every test case as PASS, then exited 2 only for the separate CLI LeakSanitizer fixture issue addressed by test(cli): isolate install plan receipt fixture #1149.

Scope

Only scripts/extract_nomic_vectors.py and vendored/nomic/code_vectors_blob.S change. No dependency, API, or runtime behavior changes beyond restoring the non-executable ELF stack declaration.

Residual validation

Native macOS and Windows assembly and the full lint toolchain were unavailable locally. The unchanged preprocessed platform branches and GitHub CI remain authoritative for those gates.