Thumb-2 CallIndirect shift lands in the type field (mov.w ip, rm, ASR #32) — always dispatches table entry 0 (shipped miscompile, masked by index-0 probes) #597

Found by the #596 (#594 A32 fix) lane while mirroring the Thumb-2 expansion: the Thumb-2 CallIndirect's mov.w ip, rm, LSL #2 actually encodes the shift amount into the TYPE field, producing mov.w ip, rm, ASR #32 — so the table index is destroyed and every call_indirect dispatches entry 0. Any probe calling index 0 (like #594's) cannot see it. Same severity class as #509/#518 (shipped-path silent wrong dispatch); directly relevant to the #275 falcon call_indirect arc. Fix = correct imm2/type encoding + a multi-entry-table differential (indexes 0,1,N) on the Thumb path; byte-level unit pin. The #596 PR froze the current (buggy) Thumb bytes deliberately to stay in-scope — that pin must be REPLACED by the corrected bytes in this fix (justified correctness re-pin).