lib+test: add shlex (POSIX split/quote) + strings.freeall

Surface mirrors ref/hare/shlex/{split,escape}.ha:

  shlex.syntaxerr            !void
  shlex.strerror(syntaxerr)  str
  shlex.split(str)           ([]str | syntaxerr)
  shlex.quote(*io.stream, s) (i32 | io.closed)
  shlex.quotestr(s) str

strings.freeall([]str) added as the natural disposer (placed next
to strings.dup, the natural creator). Skips empty {nil,0} elements
and the header free when cap==0.

POSIX rules:
- whitespace separators ' '/'\t'/'\n' (collapse runs).
- single-quote: literal until closing "'" (no escapes inside).
- double-quote: '\<c>' processed inside, any <c> (Hare-faithful;
  more permissive than POSIX strict). Unterminated → syntaxerr.
- outside quotes: '\<c>' → literal <c>; '\<newline>' deleted
  (line continuation); trailing bare '\' → syntaxerr.
- "" / '' preserve a literal empty-string token (dirty flag).

Divergences from Hare (all documented in shlex.ww header):
- drop nomem (os.alloc aborts on OOM, same precedent as
  strings.dup, getopt.appendoption).
- byte-wise cursor instead of strings::iterator (no UTF-8 rune
  iteration in the language stack yet; same precedent as fnmatch).
- *io.stream (not io::handle); (i32 | io.closed) (lib/io's
  stream vtable doesn't model wider io::error yet).
- appendstr / dupstr workarounds graduate when task #17
  (cgen mod-mangles fn labels) lands.

Test: 4 @test fns (test_split / test_quote / test_quotestr /
test_strerror), table-driven via check1/check2/check3/checkerr/
checkquote helpers. 12 split rows + 4 quote rows ported verbatim
from ref/hare/shlex/+test.ha; empty-input ([]) and empty-quote
('') edges added per documented behaviour. @test fns prefixed
test_* to avoid the use-shlex flat-concat namespace collision
on bare split / quote / quotestr / strerror names.

lib/strings/strings.ww

@@ -122,6 +122,32 @@ export fn dup(s: str) str = {
 	return r;
 };
 
+// freeall — release every str element in `s` (those that were
+// individually allocated) plus the slice's backing storage. Mirrors
+// Hare's strings::freeall — the natural disposer for any function
+// returning a fresh `[]str` of dup'd elements (e.g. shlex.split).
+//
+// Each element is freed via os.free at its own length; the slice
+// header storage is freed at `cap * 16` bytes (one str = 16B). Empty
+// elements (`{nil, 0}` from a zero-length dup) are skipped — calling
+// os.free on a nil pointer at len 0 would tickle the rt_free guard
+// that the runtime treats as a logic bug.
+//
+// `cap == 0` means the slice was never grown (empty `[]str` with no
+// backing allocation); skip the header free in that case too.
+export fn freeall(s: []str) void = {
+	let i: i32 = 0;
+	for (i < s.len) {
+		if (s[i].len > 0) {
+			os.free(s[i].ptr: *void, s[i].len: u64);
+		};
+		i += 1;
+	};
+	if (s.cap > 0) {
+		os.free(s.ptr: *void, (s.cap: u64) * 16u64);
+	};
+};
+
 // rbyteindex — last byte position of `needle` in `s`. Mirrors Hare's
 // strings::rbyteindex. Rune needle scans for the byte that encodes it
 // (ASCII only); str needle scans for the substring. Empty str needle