M6: user runtime library rt + C-convention heap

Add lib/ — the shared user-space runtime every user binary links against
(init now, servers/drivers later): syscall wrappers, the heap, IPC stub,
and the process start shim.

- lib/heap.zig: the kernel first-fit free-list ported to user space, grown
  via the mmap syscall instead of pmm+mapPage. Dual API over one global free
  list: extern "C" malloc/free/calloc/realloc (C ABI for future C code) and a
  std.mem.Allocator adapter (with in-place resize) for Zig std containers.
- lib/syscall.zig + sys.zig: raw syscall0..5 (arg3 in r10) and typed
  yield/write/sleep/exit/mmap/munmap over danos.Syscall.
- lib/start.zig: naked _start -> rt_start -> root.main() (SysV realign via
  call), panic -> exit(127).
- lib/user.ld: the user link script, moved from sbin/linker.ld (shared by all
  user binaries).
- build.zig: register the `rt` module; add an addUserBinary() helper that is
  the one recipe for every user binary (freestanding, .large, use_lld,
  user.ld, image_base), replacing the bespoke init block.
- sbin/init.zig: migrated onto rt; drops its hand-rolled syscall2/shims. Now
  proves the heap (alloc -> write from a heap pointer -> free) before the
  heartbeat loop. Serial shows "init: heap ok". Suite 28/28.

lib/ipc.zig

@@ -0,0 +1,15 @@
+//! User-space IPC helpers. The kernel's synchronous IPC syscalls
+//! (create_endpoint, ipc_register/lookup, ipc_call, ipc_reply_wait) arrive in a
+//! later milestone; this reserves the module boundary now so drivers and servers
+//! can be written against `rt.ipc` without restructuring once they light up.
+
+/// A fixed-size, register-friendly message payload. The wire format for the VFS
+/// and driver protocols is layered on top of this by the servers themselves.
+pub const Message = extern struct {
+    tag: u64 = 0,
+    a: u64 = 0,
+    b: u64 = 0,
+    c: u64 = 0,
+};
+
+// call() / replyWait() / createEndpoint() land with the kernel IPC syscalls.