Context-saving functions are attrib'd return_twice

The compiler should warn us if it was unable to generate the code that doesn't
rely on registers across the function call.

The places we used it didn't do much on the return, so this probably wasn't a
problem.  Still, it may be in the future, and this beats inspecting the
assembly.

One thing that isn't clear is whether or not returns_twice causes the compiler
to mark all registers as dead, or just the caller-saved registers.  Probably
the former.

The motivation for this is a stack clobber problem, where the compiler may save
the caller-saved registers (before calling save_user_ctx()) by pushing them on
the stack.  If this happens, when save_ returns the first time, it'll restore
the registers properly, but then could clobber that space so that the second
time it returns, the values it pops are garbage.  Hopefully the compiler will
avoid saving registers in this manner, or otherwise do anything that could be
harmed by returning twice.