lib/rt: rename rt_alloc → rt_malloc; rt.alloc → rt.malloc

Hare's canonical runtime allocator is rt::malloc with linker symbol
rt.malloc (ref/hare/rt/malloc.ha:27,78). ww kept the dot→underscore
Plan 9 convention (CLAUDE.md rule 4) so the linker symbol becomes
rt_malloc; the lib/rt exported function name becomes malloc; ww
callers say rt.malloc(...).

The language builtin keyword stays `alloc(T)!` — unchanged from Hare
(ref/hare/hare/lex/token.ha:21 ltok::ALLOC, parse/expr.ha:398
builtin()). The rename only touches the lowered linker symbol and the
exported function name behind it; the user-facing syntax for
heap-allocation is identical to Hare.

Surface:
- rt/alloc.s: TEXT rt_alloc → TEXT rt_malloc, labels updated
- lib/rt/malloc.ww: @symbol("rt_malloc") fn malloc(...) (was rt_alloc/alloc)
- rt/ensure.ww: local FFI decl + call site updated to malloc; `!` dropped
  on the direct FFI call (rt_malloc returns *void, not a tagged union)
- 18 .ww callers: rt.alloc(...) → rt.malloc(...)
- cstage cmd/wcc/check.c + wwstage selfhost/cmd/wcc/check.ww
  alloc-builtin suppression gate routes through ffi_resolve("malloc")
  for the lowering; the user-shadow check still keys on the BUILTIN
  KEYWORD "alloc" since that is what `alloc(...)` parses as. Adding
  "malloc" to the user-shadow check was unnecessary and was reverted
  during pre-commit review.
- cstage cmd/w6c/cgen.c: 2× ffi_resolve("alloc") → ffi_resolve("malloc")
- wwstage cgenexpr/cgenstmt: 2× ffiresolve(c, "alloc") → ffiresolve(c, "malloc")
- Test fixtures (700_e2e, 758_cgalloc_str_field, 990_selfhost, 992_w6l_ww,
  selfhost/test/tagged_ptr_ret.ww): updated inline ww sources to the new
  decl + call form

This is commit 2 of 3 in the lib/rt extraction (#38). Commit 3 closes
the OOM contract — return type becomes nullable *void and the builtin
lowering null-checks + propagates nomem.

Verified 132/132 + 995_self_rebuild byte-identity (5 wwstage tools
round-trip identical) + make clean cold rebuild.

examples/lisp/lispcore.ww

@@ -124,7 +124,7 @@ def ENV_SZ: u64 = 32u64;
 // result). repl() resets the trans arena between top-level forms.
 //
 // Pre-arena every cell paid the 4 KiB page-per-call cost of
-// rt_alloc; test_huge.lisp peaked at ~525 MB under massif
+// rt_malloc; test_huge.lisp peaked at ~525 MB under massif
 // --pages-as-heap=yes. With chunking alone Pass A brought that to
 // ~253 MB; per-form trans reset (this pass) drops it further by
 // reclaiming the trans high-water mark after each form.
@@ -159,7 +159,7 @@ let perm_arena:  arena;
 let trans_arena: arena;
 
 fn arena_new_chunk(prev: *chunk) *chunk = {
-	let raw: *u8 = rt.alloc(ARENA_CHUNK): *u8;
+	let raw: *u8 = rt.malloc(ARENA_CHUNK): *u8;
 	let c: *chunk = raw: *chunk;
 	c.next = prev;
 	c.cur  = 0u64;
@@ -240,7 +240,7 @@ export type eof     = !void;	// parser:  end of input — distinct from a parse
 //
 // Every v* constructor allocates one VALUE_SZ slab from the arena and
 // initialises the fields the kind needs. The cgen's
-// `alloc(value{...})` struct-literal sugar lowers to rt_alloc directly
+// `alloc(value{...})` struct-literal sugar lowers to rt_malloc directly
 // (one mmap per cell), so the constructors hand-roll the alloc + per-
 // field stores instead. Same shape as `new T(...)` in other languages.
 
@@ -343,7 +343,7 @@ def SYM_BLOBSZ: i32 = 8192;
 // a top-level `[N]T` global, because the wwstage cgen still mis-lowers
 // `globalarr[i] = …` (variable index) to `LEAQ (BP), BX` — it treats
 // the global address as if it were on the stack. Pointers indexed
-// through `[i]` go through the cmatrix path (LEAQ from rt_alloc result)
+// through `[i]` go through the cmatrix path (LEAQ from rt_malloc result)
 // which works.
 let sym_off:    *i32 = nil;
 let sym_len:    *i32 = nil;
@@ -1566,10 +1566,10 @@ fn bind_one(e: **env, name: str, id: i32) void = {
 
 export fn initsyms() void = {
 	arena_init();
-	sym_off  = rt.alloc((SYM_CAP: u64) * 4u64): *i32;
-	sym_len  = rt.alloc((SYM_CAP: u64) * 4u64): *i32;
-	sym_blob = rt.alloc(SYM_BLOBSZ: u64): *u8;
-	obuf     = rt.alloc(OBUF_SZ: u64): *u8;
+	sym_off  = rt.malloc((SYM_CAP: u64) * 4u64): *i32;
+	sym_len  = rt.malloc((SYM_CAP: u64) * 4u64): *i32;
+	sym_blob = rt.malloc(SYM_BLOBSZ: u64): *u8;
+	obuf     = rt.malloc(OBUF_SZ: u64): *u8;
 
 	// Stash the special-form ids so classify_sform sees them.
 	SID_QUOTE   = intern("quote");