rt+lib/os+test: capture envp; add os.getenv

Capture envp from the kernel-supplied stack into a DATAW slot during
_start's prologue (before CALL main), and expose it via a `rt_envp`
TEXT getter. lib/os.getenv binds the getter as `@symbol("rt_envp")
fn rtenvp() **u8` — the getter-fn pattern works around @symbol-on-let
not being supported by the compiler yet (silent miscompile otherwise).

`os.getenv(name: str) (str | void)` matches Hare's os::getenv surface:
walks the NUL-terminated envp table, "name=" prefix-matches with an
explicit `=` boundary check so prefixes don't false-match longer
names, returns the value as a borrowed str view. Empty value (env
"FOO=") returns len=0 str, not void — void is reserved for "name
not present at all".

Cohort coverage in lib/os/ostest.ww + test/wcc/974_getenv_run.c:
set / empty / unset / prefix-no-match (4 @test fns).

lib/os/os.ww

@@ -241,3 +241,63 @@ export fn getcwd(buf: *u8, n: u64) i64 = {
 export fn getdents64(fd: i32, buf: *u8, n: u64) i64 = {
 	return syscall3(nr.GETDENTS64, fd: i64, buf: i64, n: i64);
 };
+
+// ---- environment ------------------------------------------------------
+
+// rt_envp — runtime-side getter. rt/start.s captures envp into a DATAW
+// slot before calling main; this binding lifts the captured pointer
+// into ww. Same FFI shape as rt_syscall / rt_alloc / rt_abort: a TEXT
+// symbol the linker resolves. The returned `**u8` is a NUL-terminated
+// table of `*u8` entries, each pointing at a NUL-terminated
+// "NAME=VALUE" byte sequence.
+//
+// We don't expose `rtenvp` directly; [[getenv]] is the only consumer.
+@symbol("rt_envp") fn rtenvp() **u8;
+
+// getenv — POSIX getenv. Returns a borrowed `str` view over the value
+// bytes of the named environment variable, or void if the name is not
+// present. The view is valid for the process lifetime — the bytes
+// live in the kernel-supplied envp table at process entry. A future
+// `setenv` (separate task) that grows the table behind the scenes
+// would invalidate prior views; v1 has no setenv, so callers can
+// hold the view indefinitely.
+//
+// Mirrors Hare's os::tryenv shape (returns void rather than panicking
+// on missing). Hare also ships os::getenv (`(str | void)`) and
+// os::mustenv (panic-on-missing); ww collapses to the single
+// `(str | void)` form for now — consumers wanting "must" semantics
+// abort at the call site.
+//
+// Algorithm: walk the NUL-pointer-terminated `environ` table doing a
+// "name=" prefix match against each entry, byte-wise. NUL inside
+// `name` would never match a real env var (env var names cannot
+// contain '\0'), so we don't filter — POSIX puts that responsibility
+// on the caller.
+export fn getenv(name: str) (str | void) = {
+	let envp: **u8 = rtenvp();
+	let i: i32 = 0;
+	for (true) {
+		let entry: *u8 = envp[i];
+		if (entry == nil: *u8) { return; };
+		let j: i32 = 0;
+		let matched: bool = true;
+		for (j < name.len) {
+			if (entry[j] == 0u8) { matched = false; break; };
+			if (entry[j] != name[j]) { matched = false; break; };
+			j += 1;
+		};
+		if (matched) {
+			if (entry[name.len] == 61u8) {	// '='
+				let val: *u8 = entry + ((name.len + 1): u64);
+				let n: i32 = 0;
+				for (val[n] != 0u8) { n += 1; };
+				let r: str;
+				r.ptr = val;
+				r.len = n;
+				return r;
+			};
+		};
+		i += 1;
+	};
+	return;
+};