kernel+tests: M4 shared-fate — nine group-death test cases, per-space arena cursors

Eight new QEMU cases (thread-fault-group, kill-threaded-group,
kill-via-worker-tid, racing-triggers, exit-group, leader-thread-exit,
thread-exit-solo, shm-mapping-ref) driving seven new thread-test modes; a
shared checkGroupDead asserts the contract everywhere: one notification,
badged with the leader, reason on the leader's record, no member listed,
claims released first.

The shm-mapping-ref case flushed out the per-task DMA/shared-memory arena
cursor bug directly (a sibling's regions mapped over the worker's), so both
cursors moved to the AddressSpaceRef like the mmap/MMIO cursors before them
(threading M7 pattern). Runtime gains Thread.tryExitCurrent for the leader
-EPERM refusal path. Docs updated: threading.md's shared-fate gap is closed,
process-management.md and process-lifecycle.md describe the leader re-key,
plan status = implemented. Full suite: 100/100.

library/runtime/thread.zig

@@ -120,6 +120,15 @@ pub const Thread = struct {
         return @intCast(sc.systemCall0(.current_core));
     }
 
+    /// Ask the kernel to end the calling thread. A WORKER never returns from this;
+    /// the process's MAIN thread gets the kernel's refusal (-EPERM — the group ends
+    /// only through exit, a fault, or process_kill, docs/shared-fate-plan.md) and
+    /// the call returns. Exists for exactly that refusal path; workers end through
+    /// the spawn trampoline, and a process ends through `system.exit`.
+    pub fn tryExitCurrent() void {
+        _ = sc.systemCall0(.thread_exit);
+    }
+
     /// `std.Thread.Futex`-shaped block/wake on a `u32` atomic — the primitive the
     /// blocking `Mutex`/`Condition`/`Semaphore` are built on. Waiters park in the
     /// kernel (no busy-wait), so an idle core still halts (docs/halting.md).