fossilize: SEA code-cache generation requires two sign passes — copy elimination is the only optimization

The cache must be generated in the signed state (matching V8 FlagList::Hash() of the final binary) before postject injection, and the final signature must cover the post-inject blob. Two sign passes are therefore fundamental and cannot be deduplicated. The optimization available is eliminating the ~100MB throwaway seed copy: sign in place → generate cache → unsign in place → inject → final sign. Cross-compile targets (non-host platforms) skip cache generation entirely; only the host platform runs this flow.