[FIX] Load ORC JIT addon through TVM-FFI

[cyx-6]

Why

#807 localized the ORCJIT addon and its linked runtimes, but retained a second raw ctypes.CDLL(..., RTLD_NODELETE) handle to keep the addon mapped through process shutdown. The addon should use the standard tvm_ffi.load_module path exclusively.

Simply deleting the raw handle exposed a SIGSEGV during process exit when a JIT module was pinned with keep_module_alive=True. TVM-FFI's ModuleGlobals describes its entries as modules that should not be unloaded, but the registry itself was a destructible function-local static. Static teardown could therefore unload a DSO while the process-global function table and other dependents still held callbacks whose code belonged to it.

What changed

• load and retain the ORCJIT addon only with tvm_ffi.load_module(..., keep_module_alive=True)
• remove the duplicate ctypes.CDLL, RTLD_NODELETE, and Windows DLL-directory handling
• stop library discovery after the first valid install/editable candidate
• make TVM-FFI's keep-alive module registry genuinely process-lifetime, consistent with its contract and with the existing process-lifetime global function table
• update keep_module_alive documentation to state that pinned modules live for the duration of the process
• add a child-process regression that pins a JIT module, drops the local reference, and verifies clean shutdown

Validation

• before the ModuleGlobals lifetime fix, the new shutdown reproducer exited with SIGSEGV (returncode == -11)
• after the fix, the shutdown reproducer exits cleanly
• native manylinux_2_28 ARM64 container with LLVM 22.1.0
• ORCJIT addon tests: 92 passed, 23 skipped in both serial and pytest-xdist runs
• TVM-FFI build/load regression tests: 8 passed
• C and C++ ORCJIT quick-start examples
• nm -D --defined-only: exactly TVMFFIOrcJITInitialize
• all repository pre-commit hooks on changed files
• hosted CI pending