rt+lib/os+test: capture envp; add os.getenv

Capture envp from the kernel-supplied stack into a DATAW slot during
_start's prologue (before CALL main), and expose it via a `rt_envp`
TEXT getter. lib/os.getenv binds the getter as `@symbol("rt_envp")
fn rtenvp() **u8` — the getter-fn pattern works around @symbol-on-let
not being supported by the compiler yet (silent miscompile otherwise).

`os.getenv(name: str) (str | void)` matches Hare's os::getenv surface:
walks the NUL-terminated envp table, "name=" prefix-matches with an
explicit `=` boundary check so prefixes don't false-match longer
names, returns the value as a borrowed str view. Empty value (env
"FOO=") returns len=0 str, not void — void is reserved for "name
not present at all".

Cohort coverage in lib/os/ostest.ww + test/wcc/974_getenv_run.c:
set / empty / unset / prefix-no-match (4 @test fns).

lib/os/os.ww

@@ -241,3 +241,63 @@ export fn getcwd(buf: *u8, n: u64) i64 = {
 export fn getdents64(fd: i32, buf: *u8, n: u64) i64 = {
 	return syscall3(nr.GETDENTS64, fd: i64, buf: i64, n: i64);
 };
+
+// ---- environment ------------------------------------------------------
+
+// rt_envp — runtime-side getter. rt/start.s captures envp into a DATAW
+// slot before calling main; this binding lifts the captured pointer
+// into ww. Same FFI shape as rt_syscall / rt_alloc / rt_abort: a TEXT
+// symbol the linker resolves. The returned `**u8` is a NUL-terminated
+// table of `*u8` entries, each pointing at a NUL-terminated
+// "NAME=VALUE" byte sequence.
+//
+// We don't expose `rtenvp` directly; [[getenv]] is the only consumer.
+@symbol("rt_envp") fn rtenvp() **u8;
+
+// getenv — POSIX getenv. Returns a borrowed `str` view over the value
+// bytes of the named environment variable, or void if the name is not
+// present. The view is valid for the process lifetime — the bytes
+// live in the kernel-supplied envp table at process entry. A future
+// `setenv` (separate task) that grows the table behind the scenes
+// would invalidate prior views; v1 has no setenv, so callers can
+// hold the view indefinitely.
+//
+// Mirrors Hare's os::tryenv shape (returns void rather than panicking
+// on missing). Hare also ships os::getenv (`(str | void)`) and
+// os::mustenv (panic-on-missing); ww collapses to the single
+// `(str | void)` form for now — consumers wanting "must" semantics
+// abort at the call site.
+//
+// Algorithm: walk the NUL-pointer-terminated `environ` table doing a
+// "name=" prefix match against each entry, byte-wise. NUL inside
+// `name` would never match a real env var (env var names cannot
+// contain '\0'), so we don't filter — POSIX puts that responsibility
+// on the caller.
+export fn getenv(name: str) (str | void) = {
+	let envp: **u8 = rtenvp();
+	let i: i32 = 0;
+	for (true) {
+		let entry: *u8 = envp[i];
+		if (entry == nil: *u8) { return; };
+		let j: i32 = 0;
+		let matched: bool = true;
+		for (j < name.len) {
+			if (entry[j] == 0u8) { matched = false; break; };
+			if (entry[j] != name[j]) { matched = false; break; };
+			j += 1;
+		};
+		if (matched) {
+			if (entry[name.len] == 61u8) {	// '='
+				let val: *u8 = entry + ((name.len + 1): u64);
+				let n: i32 = 0;
+				for (val[n] != 0u8) { n += 1; };
+				let r: str;
+				r.ptr = val;
+				r.len = n;
+				return r;
+			};
+		};
+		i += 1;
+	};
+	return;
+};

lib/os/ostest.ww

@@ -0,0 +1,98 @@
+// ostest — exercises lib/os surface that doesn't have a dedicated
+// test elsewhere. v1 covers [[os.getenv]] only, against an env state
+// pre-arranged by the C driver (test/wcc/974_getenv_run.c).
+//
+// Convention follows the stdlib `_run` test fixtures: hand-rolled
+// @test fns dispatched from `main()` in numeric order, with a
+// `signalled` global the main fn bumps so a failing case exits with
+// `WEXITSTATUS = signalled + 10` — the harness then knows which
+// scenario tripped. Same shape as temptest / shlextest / fnmatchtest.
+//
+// Pre-arranged env state (set by 974_getenv_run.c via setenv/unsetenv
+// before exec'ing `ww run lib/os/ostest.ww`):
+//
+//   WW_TEST_GETENV     = "hello-world"
+//   WW_TEST_EMPTY      = ""           (set, but value is empty)
+//   WW_TEST_NOT_SET    unset
+//
+// Don't `use io;` here — lib/os and lib/io both export read/write/
+// close as C symbols that collide under the driver's flat-scope
+// concat (task #17). os alone is sufficient: getenv + exit are the
+// only primitives needed.
+
+use os;
+
+let signalled: i32 = 0;
+
+fn fail() void = { os.exit(signalled + 10); };
+
+fn streq(a: str, b: str) bool = {
+	if (a.len != b.len) { return false; };
+	let i: i32 = 0;
+	for (i < a.len) {
+		if (a[i] != b[i]) { return false; };
+		i += 1;
+	};
+	return true;
+};
+
+// ---- getenv: set var → matching value -------------------------------
+
+@test fn test_getenv_set() void = {
+	let r = os.getenv("WW_TEST_GETENV");
+	match (r) {
+	case void => fail();
+	case let s: str => {
+		if (!streq(s, "hello-world")) { fail(); };
+	};
+	};
+};
+
+// ---- getenv: empty value (set but zero-length) ----------------------
+//
+// POSIX permits an env var with an empty value (`name=` in environ).
+// getenv must return the empty str, NOT void — void is reserved for
+// "name not present at all". This row exercises the boundary.
+
+@test fn test_getenv_empty() void = {
+	let r = os.getenv("WW_TEST_EMPTY");
+	match (r) {
+	case void => fail();
+	case let s: str => {
+		if (s.len != 0) { fail(); };
+	};
+	};
+};
+
+// ---- getenv: unset var → void ---------------------------------------
+
+@test fn test_getenv_unset() void = {
+	let r = os.getenv("WW_TEST_NOT_SET");
+	match (r) {
+	case void => {};
+	case let s: str => fail();
+	};
+};
+
+// ---- getenv: prefix-collision guard ---------------------------------
+//
+// Probes that "WW_TEST_GETEN" (a prefix of WW_TEST_GETENV) doesn't
+// match. Without the explicit `entry[name.len] == '='` check in
+// getenv, a naive prefix matcher would return the value of any
+// longer-named var that starts with the queried name.
+
+@test fn test_getenv_prefix_no_match() void = {
+	let r = os.getenv("WW_TEST_GETEN");
+	match (r) {
+	case void => {};
+	case let s: str => fail();
+	};
+};
+
+export fn main() i32 = {
+	signalled = 1; test_getenv_set();
+	signalled = 2; test_getenv_empty();
+	signalled = 3; test_getenv_unset();
+	signalled = 4; test_getenv_prefix_no_match();
+	return 0;
+};