M6: user runtime library rt + C-convention heap

Add lib/ — the shared user-space runtime every user binary links against
(init now, servers/drivers later): syscall wrappers, the heap, IPC stub,
and the process start shim.

- lib/heap.zig: the kernel first-fit free-list ported to user space, grown
  via the mmap syscall instead of pmm+mapPage. Dual API over one global free
  list: extern "C" malloc/free/calloc/realloc (C ABI for future C code) and a
  std.mem.Allocator adapter (with in-place resize) for Zig std containers.
- lib/syscall.zig + sys.zig: raw syscall0..5 (arg3 in r10) and typed
  yield/write/sleep/exit/mmap/munmap over danos.Syscall.
- lib/start.zig: naked _start -> rt_start -> root.main() (SysV realign via
  call), panic -> exit(127).
- lib/user.ld: the user link script, moved from sbin/linker.ld (shared by all
  user binaries).
- build.zig: register the `rt` module; add an addUserBinary() helper that is
  the one recipe for every user binary (freestanding, .large, use_lld,
  user.ld, image_base), replacing the bespoke init block.
- sbin/init.zig: migrated onto rt; drops its hand-rolled syscall2/shims. Now
  proves the heap (alloc -> write from a heap pointer -> free) before the
  heartbeat loop. Serial shows "init: heap ok". Suite 28/28.

lib/start.zig

@@ -0,0 +1,32 @@
+//! The user-space process entry shim. Every user binary roots `_start` here (via
+//! `entry = _start` in build.zig) and forces this file to be analysed with
+//! `comptime { _ = &rt.start._start; }`, so the whole runtime is linked in.
+
+const std = @import("std");
+const sys = @import("sys.zig");
+
+/// The kernel enters at `_start` with rsp 16-aligned, but a SysV function expects
+/// rsp ≡ 8 (mod 16) on entry (as if reached by `call`). The `call` below pushes
+/// the 8-byte return address, satisfying the ABI before any Zig frame runs; the
+/// `ud2` is a safety net if `rt_start` ever returns.
+pub export fn _start() callconv(.naked) noreturn {
+    asm volatile (
+        \\call rt_start
+        \\ud2
+    );
+}
+
+/// The first Zig frame. The heap is lazy (first alloc grows it), so there is no
+/// runtime init to order here — just hand control to the program's `main`.
+export fn rt_start() callconv(.c) noreturn {
+    const root = @import("root"); // the user binary's root source file
+    root.main();
+    sys.exit(0);
+}
+
+/// No runtime to unwind into — report a panic as a nonzero exit code.
+pub const panic = std.debug.FullPanic(struct {
+    fn panic(_: []const u8, _: ?usize) noreturn {
+        sys.exit(127);
+    }
+}.panic);