ww: driver shells to wwstage tools

build_one now invokes 6c_ww / 6a_ww / 6l_ww from $self_dir, not
the C-built binaries that share the directory. After this change
`ww_ww build foo.ww` touches no cstage code at runtime — the
fresh-checkout cstage is still needed to bring the wwstage into
existence, but day-to-day work runs on the ww toolchain end to
end. The C `ww` driver in cmd/ww/ still drives the C 6c/6a/6l.

Test 993 (which used to be trivial — both drivers invoked the
same C tools) now meaningfully compares the cstage pipeline
against the wwstage pipeline on hello + wwdump and confirms
byte-identical exes.

The .combined.ww files for 6a/6l/ww/wwdump and smoke are
regenerated by the ww driver's `expand()` step; their diff is
the lib/os dup2 wrapper and the cgen.ww port from the prior two
commits, propagating into the bootstrap inputs.

selfhost/test/smoke.combined.ww

@@ -24,6 +24,7 @@ def SYS_OPEN:   i64 = 2;
 def SYS_CLOSE:  i64 = 3;
 def SYS_LSEEK:  i64 = 8;
 def SYS_ACCESS: i64 = 21;
+def SYS_DUP2:   i64 = 33;
 def SYS_GETPID: i64 = 39;
 def SYS_FORK:   i64 = 57;
 def SYS_EXECVE: i64 = 59;
@@ -62,6 +63,14 @@ export fn close(fd: i32) i32 = {
 	return syscall1(SYS_CLOSE, fd: i64): i32;
 };
 
+// dup2(2): make `newfd` refer to the same description as `oldfd`,
+// closing `newfd` first if open. Returns `newfd` on success or a
+// negative errno. Used by 6c_ww to redirect stdout into an output
+// file without changing the cgen emit path.
+export fn dup2(oldfd: i32, newfd: i32) i32 = {
+	return syscall2(SYS_DUP2, oldfd: i64, newfd: i64): i32;
+};
+
 // Fallible wrappers. The error variant is a plain str (Plan 9 errstr
 // model, see lib/errors); the sum type makes success/failure explicit
 // without overloading length-zero.