lib: α-batch-2 rt.malloc → alloc([], N)! (path/shlex/fmt/ostest)

Phase 0 #8 second α-batch. 7 sites: lib/path/path.ww `join` ×4,
lib/shlex/shlex.ww `dupstr`, lib/fmt/fmt.ww `asprintf` tight-copy,
lib/os/ostest.ww `test_alloc_free_roundtrip`. Same dup-pilot pattern
(4c07ef0, 47918d3): `alloc([], N)!` + `buf.len = N;` +
`return strings.frombytes(buf);`.

Side effects:
- path/shlex/fmt: import switches `rt` → `strings` (callers now
  reference `strings.frombytes`, not `rt.malloc` direct).
- ostest.ww: `import rt;` retained — the alloc builtin lowers to
  `CALL malloc(SB)` which resolves via rt's @symbol("rt_malloc")
  decl. Other files reach rt transitively via `import strings`;
  ostest only imports os, so it needs the explicit rt import.
- shlex stale comment "avoid strings dep" stripped — strings is now
  in scope.

Verified make test 132/132 + 995_self_rebuild byte-identity.
Advances #43.

lib/fmt/fmt.ww

@@ -29,7 +29,7 @@ package fmt;
 import io;
 import memio;
 import os;
-import rt;
+import strings;
 import strconv;
 
 // i64dec_buf — scratch buffer for [[i64dec]] below. Module-level
@@ -886,7 +886,7 @@ export fn asprintf(fmt: str, args: field...) str = {
 		match (cres) { case void => {}; case io.closed => {}; };
 		return out;
 	};
-	let tight: *u8 = rt.malloc(view.len: u64): *u8;
+	let tight: []u8 = alloc([], view.len: u64)!;
 	let i: i32 = 0;
 	for (i < view.len) {
 		tight[i] = view.ptr[i];
@@ -894,7 +894,6 @@ export fn asprintf(fmt: str, args: field...) str = {
 	};
 	let cres: (void | io.closed) = io.close(&s);
 	match (cres) { case void => {}; case io.closed => {}; };
-	out.ptr = tight;
-	out.len = view.len;
-	return out;
+	tight.len = view.len;
+	return strings.frombytes(tight);
 };