threads: design doc + /loop build plan

Add docs/threading.md (native runtime.Thread mirroring std.Thread over a
private thread ABI) and docs/threading-plan.md (6 milestones, each with a
serial-checkable gate + guardrail, plus an unattended /loop execution
contract). Index both in docs/README.md.

docs/README.md

@@ -104,6 +104,12 @@ Start with the north star:
   port to **one seam** (`std.os.danos`), so we build `runtime.os` (→ that seam) plus a
   thin `runtime.fs`, retire the `posix` shim, and follow a phased path to
   `zig build-exe hello.zig` running on danos — **not** Linux-ABI emulation.
+- **[threading.md](threading.md) — threads, the std-shaped way.** A design note (not
+  built yet) on `runtime.Thread`: a type that mirrors `std.Thread`'s API (spawn/join,
+  Mutex/Condition) over a **private** thread ABI — several tasks sharing one address
+  space via a `thread_spawn` syscall, futex-backed blocking, aspace refcounting. Why
+  it's the native type and not literal `std.Thread` (the [private ABI](syscall.md)),
+  and why threads stay a narrow opt-in against the [resilience](resilience.md) default.
 - **[vdso.md](vdso.md) — the vDSO, the public system-call boundary.** A design note
   (not built yet) on keeping `abi.zig` genuinely private: a kernel-supplied, C-ABI
   entry blob mapped into every process as the *only* way into the kernel — so the