Add support for crude region analysis to enable sharing of functions that malloc but the mallocs can be shown not to escape.
Add a first shot at a prepare-for-specialisation pass, which takes a callstack that is targeted for specialisation and selectively clones elements of the function accompanied by guards, yielding two tails: one that reaches a target function along that path, and one which does not. The specialiser proper can then be instructed to ignore one of those tails and make corresponding assumptions along the other.