kernel+tests: M4 shared-fate — nine group-death test cases, per-space arena cursors

Eight new QEMU cases (thread-fault-group, kill-threaded-group,
kill-via-worker-tid, racing-triggers, exit-group, leader-thread-exit,
thread-exit-solo, shm-mapping-ref) driving seven new thread-test modes; a
shared checkGroupDead asserts the contract everywhere: one notification,
badged with the leader, reason on the leader's record, no member listed,
claims released first.

The shm-mapping-ref case flushed out the per-task DMA/shared-memory arena
cursor bug directly (a sibling's regions mapped over the worker's), so both
cursors moved to the AddressSpaceRef like the mmap/MMIO cursors before them
(threading M7 pattern). Runtime gains Thread.tryExitCurrent for the leader
-EPERM refusal path. Docs updated: threading.md's shared-fate gap is closed,
process-management.md and process-lifecycle.md describe the leader re-key,
plan status = implemented. Full suite: 100/100.

docs/threading.md

@@ -252,20 +252,18 @@ stays single-threaded and lean.
   halts" property intact under lock contention — no busy-wait.
 - **Lifecycle** ([process-lifecycle.md](process-lifecycle.md)): the contract is that
   killing a process kills *all* its threads and only then drops the last address-space
-  ref. **The kernel does not implement that fan-out yet**: `process_kill` reaps only
-  the one task it resolves, and no death path loops over the tasks sharing an address
-  space — the refcount keeps the space (and the sibling threads) alive and running.
-  The gap is hit in practice: of the only threaded binaries (the `display` service and
-  the `thread-test` harness), `display` is a boot service that handles no `.terminate`
-  signal, so init's stop sequence escalates to `process_kill` on every orderly
-  shutdown — benign only because poweroff follows. Whether to implement the fan-out or
-  amend the contract is a decision still to be made.
+  ref — and the kernel now implements exactly that
+  ([shared-fate-plan.md](shared-fate-plan.md)): every death path (`exit` from any
+  thread, a fault, `process_kill` aimed at any member id) fans out through the whole
+  group via a `dying` latch on the address space; the supervisor's one exit
+  notification — badged with the leader — fires only when the last member is gone.
+  A worker's voluntary `thread_exit` stays per-thread; the leader's is refused
+  (`-EPERM`).
 - **Resilience** ([resilience.md](resilience.md)): by the same contract, a faulting
   thread kills its whole process (shared fate); the supervisor restarts the
   **process**, which respawns its threads from a known-good state — restart
-  granularity stays the process. Today a CPU fault kills only the faulting task
-  (`killCurrentProcess` tears down a single task), so sibling threads keep running —
-  the same implementation gap as above.
+  granularity stays the process. The leader's recorded exit reason carries the fault
+  class even when a worker faulted, so restart policy is unchanged.
 - **IPC — two consequences threads forced ([ipc.md](ipc.md)):**
   - *Handles do not cross threads.* The handle table lives on the `Task`
     ([scheduler.zig](../system/kernel/scheduler.zig)), so a handle number is meaningful