rt+lib/os+test: capture envp; add os.getenv

Capture envp from the kernel-supplied stack into a DATAW slot during
_start's prologue (before CALL main), and expose it via a `rt_envp`
TEXT getter. lib/os.getenv binds the getter as `@symbol("rt_envp")
fn rtenvp() **u8` — the getter-fn pattern works around @symbol-on-let
not being supported by the compiler yet (silent miscompile otherwise).

`os.getenv(name: str) (str | void)` matches Hare's os::getenv surface:
walks the NUL-terminated envp table, "name=" prefix-matches with an
explicit `=` boundary check so prefixes don't false-match longer
names, returns the value as a borrowed str view. Empty value (env
"FOO=") returns len=0 str, not void — void is reserved for "name
not present at all".

Cohort coverage in lib/os/ostest.ww + test/wcc/974_getenv_run.c:
set / empty / unset / prefix-no-match (4 @test fns).

lib/os/ostest.ww

@@ -0,0 +1,98 @@
+// ostest — exercises lib/os surface that doesn't have a dedicated
+// test elsewhere. v1 covers [[os.getenv]] only, against an env state
+// pre-arranged by the C driver (test/wcc/974_getenv_run.c).
+//
+// Convention follows the stdlib `_run` test fixtures: hand-rolled
+// @test fns dispatched from `main()` in numeric order, with a
+// `signalled` global the main fn bumps so a failing case exits with
+// `WEXITSTATUS = signalled + 10` — the harness then knows which
+// scenario tripped. Same shape as temptest / shlextest / fnmatchtest.
+//
+// Pre-arranged env state (set by 974_getenv_run.c via setenv/unsetenv
+// before exec'ing `ww run lib/os/ostest.ww`):
+//
+//   WW_TEST_GETENV     = "hello-world"
+//   WW_TEST_EMPTY      = ""           (set, but value is empty)
+//   WW_TEST_NOT_SET    unset
+//
+// Don't `use io;` here — lib/os and lib/io both export read/write/
+// close as C symbols that collide under the driver's flat-scope
+// concat (task #17). os alone is sufficient: getenv + exit are the
+// only primitives needed.
+
+use os;
+
+let signalled: i32 = 0;
+
+fn fail() void = { os.exit(signalled + 10); };
+
+fn streq(a: str, b: str) bool = {
+	if (a.len != b.len) { return false; };
+	let i: i32 = 0;
+	for (i < a.len) {
+		if (a[i] != b[i]) { return false; };
+		i += 1;
+	};
+	return true;
+};
+
+// ---- getenv: set var → matching value -------------------------------
+
+@test fn test_getenv_set() void = {
+	let r = os.getenv("WW_TEST_GETENV");
+	match (r) {
+	case void => fail();
+	case let s: str => {
+		if (!streq(s, "hello-world")) { fail(); };
+	};
+	};
+};
+
+// ---- getenv: empty value (set but zero-length) ----------------------
+//
+// POSIX permits an env var with an empty value (`name=` in environ).
+// getenv must return the empty str, NOT void — void is reserved for
+// "name not present at all". This row exercises the boundary.
+
+@test fn test_getenv_empty() void = {
+	let r = os.getenv("WW_TEST_EMPTY");
+	match (r) {
+	case void => fail();
+	case let s: str => {
+		if (s.len != 0) { fail(); };
+	};
+	};
+};
+
+// ---- getenv: unset var → void ---------------------------------------
+
+@test fn test_getenv_unset() void = {
+	let r = os.getenv("WW_TEST_NOT_SET");
+	match (r) {
+	case void => {};
+	case let s: str => fail();
+	};
+};
+
+// ---- getenv: prefix-collision guard ---------------------------------
+//
+// Probes that "WW_TEST_GETEN" (a prefix of WW_TEST_GETENV) doesn't
+// match. Without the explicit `entry[name.len] == '='` check in
+// getenv, a naive prefix matcher would return the value of any
+// longer-named var that starts with the queried name.
+
+@test fn test_getenv_prefix_no_match() void = {
+	let r = os.getenv("WW_TEST_GETEN");
+	match (r) {
+	case void => {};
+	case let s: str => fail();
+	};
+};
+
+export fn main() i32 = {
+	signalled = 1; test_getenv_set();
+	signalled = 2; test_getenv_empty();
+	signalled = 3; test_getenv_unset();
+	signalled = 4; test_getenv_prefix_no_match();
+	return 0;
+};