w6l: route writable globals into a second PT_LOAD

Second step toward top-level mutable `let`. The static path now loads
.data PROGBITS sections from input .o files, page-aligns them after
.text, and emits a second PT_LOAD (R+W) covering them. Relocations
targeting data symbols compute against the data VA; text→text
displacements still cancel the absolute VAs and stay correct.

Inputs without any .data keep the original single-PT_LOAD layout
byte-for-byte — 992 (selfhost w6l .o diff) and 995 (self-rebuild)
depend on that invariant.

Dynamic-link path (-l/-L) rejects .data for now with a clear error;
folding writable globals into the existing R+W segment alongside
.got.plt/.dynamic is a follow-up.

Makefile

@@ -211,6 +211,7 @@ $(BIN) $(LIB) $(OBJ)/wcc $(OBJ)/ww $(OBJ)/wwdump $(OBJ)/w6c $(OBJ)/w6a $(OBJ)/w6
 # Each phase adds a $(BIN)/test_<name> target; the runner walks them.
 TESTS	= $(BIN)/test_smoke $(BIN)/test_lex $(BIN)/test_parse $(BIN)/test_check \
 	  $(BIN)/test_w6c $(BIN)/test_w6a $(BIN)/test_dataw $(BIN)/test_w6l \
+	  $(BIN)/test_data_link \
 	  $(BIN)/test_arch \
 	  $(BIN)/test_e2e $(BIN)/test_ffi $(BIN)/test_dyn $(BIN)/test_stdlib \
 	  $(BIN)/test_at_test \
@@ -242,6 +243,9 @@ $(BIN)/test_dataw: test/wcc/510_dataw.c $(BIN)/w6a | $(BIN)
 $(BIN)/test_w6l: test/wcc/600_w6l.c $(BIN)/w6c $(BIN)/w6a $(BIN)/w6l | $(BIN)
 	$(CC) $(CFLAGS) -o $@ $<
 
+$(BIN)/test_data_link: test/wcc/620_data_link.c $(BIN)/w6a $(BIN)/w6l | $(BIN)
+	$(CC) $(CFLAGS) -o $@ $<
+
 $(BIN)/test_arch: test/wcc/610_arch.c $(BIN)/w6c $(BIN)/w6a $(BIN)/w6l \
 		$(OBJ)/rt/start.o | $(BIN)
 	$(CC) $(CFLAGS) -o $@ $<