lib: drop _unsafe convention; rename fromutf8_unsafe → frombytes; strings α-batch (concat/join/lpad/rpad)

CLAUDE.md rule 9 amended with the explicit carve-out: ww is C/Plan-9-
lineage — no GC, no "safe" baseline to be unsafe relative to — so the
Hare `_unsafe` suffix flags an axis ww doesn't have. The convention
is dropped wholesale in lib/.

Concrete changes:
- lib/strings: `fromutf8_unsafe` → `frombytes` (pure reinterpret). The
  validating sibling `fromutf8` is deleted entirely (28 lines, plus its
  84-line fromutf8_cases test). Callers that need validation write the
  two lines inline at the IO source: `utf8.validate(b)?;
  let s = strings.frombytes(b);`. `fromutf8` name reserved for a future
  true validating helper.
- lib/strings α-batch: concat/join/lpad/rpad migrate from
  `rt.malloc(N): *u8` to `alloc([], N)!` + `buf.len = N;` +
  `return frombytes(buf);`. Same dup-pilot pattern (4c07ef0). Task #41.
- lib/memio header comment trimmed: drops a stale reference to
  "lib has no fromutf8 today"; cites the rule-9 carve-out instead.
- Caller renames across selfhost combined.ww files (auto-regen) +
  cgenutil.ww comment ref.

Rule-11 disclosure on the bundle: the rename and the α-batch are
nominally separable concerns (symbol-naming policy vs amalloc→
alloc-slice migration), but they touch the same 4 functions in
lib/strings/strings.ww — the α-batch's first emission of `frombytes`
postdates the rename. The α-batch was applied on top of the rename
sweep mid-flight by the pre-commit reviewer; splitting them back
out is fiddly text surgery for marginal bisect value. The rename is
the primary concern; α-batch is one entry in #8's sized-slice
migration.

Verified: make test 132/132, 995_self_rebuild byte-identity holds.
Closes #42; advances #41.

lib/memio/memio.ww

@@ -20,11 +20,11 @@
 //
 // Subset of Hare's surface: io.stream's variants are {eof, closed},
 // so memio drops Hare's NONBLOCK flag (would need an `again` variant
-// in lib/io) and string()'s utf8 validation (lib has no fromutf8
-// today). Hare's seek / copy callbacks are likewise absent: lib/io's
-// stream vtable has only read/write/close slots, so memio can't wire
-// a seeker or copier even if we wanted to. All three come back when
-// their dependencies do.
+// in lib/io). string()'s utf8-validating constructor is omitted per
+// CLAUDE.md rule 9 carve-out. Hare's seek / copy callbacks are
+// likewise absent: lib/io's stream vtable has only read/write/close
+// slots, so memio can't wire a seeker or copier even if we wanted
+// to. All three come back when their dependencies do.
 
 package memio;