lib: α-batch-2 rt.malloc → alloc([], N)! (path/shlex/fmt/ostest)

Phase 0 #8 second α-batch. 7 sites: lib/path/path.ww `join` ×4,
lib/shlex/shlex.ww `dupstr`, lib/fmt/fmt.ww `asprintf` tight-copy,
lib/os/ostest.ww `test_alloc_free_roundtrip`. Same dup-pilot pattern
(4c07ef0, 47918d3): `alloc([], N)!` + `buf.len = N;` +
`return strings.frombytes(buf);`.

Side effects:
- path/shlex/fmt: import switches `rt` → `strings` (callers now
  reference `strings.frombytes`, not `rt.malloc` direct).
- ostest.ww: `import rt;` retained — the alloc builtin lowers to
  `CALL malloc(SB)` which resolves via rt's @symbol("rt_malloc")
  decl. Other files reach rt transitively via `import strings`;
  ostest only imports os, so it needs the explicit rt import.
- shlex stale comment "avoid strings dep" stripped — strings is now
  in scope.

Verified make test 132/132 + 995_self_rebuild byte-identity.
Advances #43.

lib/shlex/shlex.ww

@@ -97,7 +97,7 @@ package shlex;
 import io;
 import memio;
 import os;
-import rt;
+import strings;
 
 // rt_ensure is the runtime slice-growth helper invoked by the
 // `append(s, v)` builtin. We bind it directly because the builtin's
@@ -118,20 +118,18 @@ export fn strerror(err: syntaxerr) str = {
 	return "Invalid shell syntax";
 };
 
-// dupstr — local strings.dup. Inlined to avoid a `use strings;` dep
-// on this small site; same algorithm and same {nil, 0} handling for
-// empty input.
+// dupstr — local strings.dup. Inlined (same algorithm and same
+// {nil, 0} handling for empty input).
 fn dupstr(s: str) str = {
 	let r: str;
 	r.ptr = nil;
 	r.len = 0;
 	if (s.len == 0) { return r; };
-	let buf: *u8 = rt.malloc(s.len: u64): *u8;
+	let buf: []u8 = alloc([], s.len: u64)!;
 	let i: i32 = 0;
 	for (i < s.len) { buf[i] = s[i]; i += 1; };
-	r.ptr = buf;
-	r.len = s.len;
-	return r;
+	buf.len = s.len;
+	return strings.frombytes(buf);
 };
 
 // appendstr — grow `*slice` by one and store `item` (16B). Bypasses