fix: add -Wl,-z,noexecstack to prevent dlopen failure on modern kernels

Modern kernels (Linux 6.x, OrbStack) reject dlopen of shared objects with
PT_GNU_STACK RWE (executable stack) flag. gfortran historically sets this flag
as a conservative measure for Fortran nested function trampolines.

Analysis confirmed zero risk: wsjtx_lib contains 414 Fortran source files with
no CONTAINS keyword, meaning no nested internal procedures and no trampolines.

Applied to both targets on Linux/Unix:
- wsjtx_core shared library (root cause, directly linked with gfortran)
- wsjtx_lib_nodejs .node module (inherits flag transitively)

Windows (MinGW) unaffected: flag is in UNIX-only branch and would be silently
ignored by PE format linker regardless.

Author: boybook

CMakeLists.txt

@@ -291,6 +291,10 @@ elseif(UNIX)
     if(FFTW_HAS_THREADS)
         target_link_libraries(wsjtx_core PRIVATE fftw3f_threads)
     endif()
+    # Prevent execstack: modern kernels (and OrbStack) reject dlopen of .so with PT_GNU_STACK RWE.
+    # Safe because wsjtx_lib Fortran code has no nested internal procedures (no CONTAINS),
+    # so gfortran never generates trampolines requiring executable stack.
+    target_link_options(wsjtx_core PRIVATE -Wl,-z,noexecstack)
 elseif(WIN32)
     # Static-link ALL non-system dependencies so wsjtx_core.dll only depends
     # on Windows system DLLs (KERNEL32.dll, msvcrt.dll). This prevents DLL
@@ -416,8 +420,9 @@ foreach(cfg Debug Release RelWithDebInfo MinSizeRel)
     )
 endforeach()
 
-# Linux RPATH for .node
+# Linux RPATH for .node + prevent execstack
 if(UNIX AND NOT APPLE)
+    target_link_options(${PROJECT_NAME} PRIVATE -Wl,-z,noexecstack)
     set_target_properties(${PROJECT_NAME} PROPERTIES
         BUILD_RPATH "\$ORIGIN"
         INSTALL_RPATH "\$ORIGIN"

package-lock.json

@@ -1,6 +1,6 @@
 {
   "name": "wsjtx-lib",
-  "version": "1.2.1",
+  "version": "1.2.2",
   "description": "Node.js C++ extension for WSJTX digital radio protocol library",
   "type": "module",
   "main": "dist/src/index.js",