Function image_for 

pub fn image_for(prog: &Program) -> Image

Build the Image for a program: its code (body + signature epilogue) plus the appended ecalli 0 terminator, entered at pc 0 with the program’s initial register seed.

The Image always maps the scratchpad (slot[0]) signature region at SIG_BASE (via add_signature_region); the program’s signature epilogue stores its register file there, and both engines surface the region’s effective bytes for the lossless differential.

When the program declares an init_mem window, the Image declares a matching RW data mapping so both engines size their data extent to cover it and lazily materialize (category #3) the same pages. The window is backed by an empty initial slot (zero-filled, page-aligned mem_buf), so both engines treat it as ephemeral — the lazy-materialization charge is identical regardless, and this keeps the differential off the cap-PA page-in path (whose alignment is a separate concern).