lib/rt: rename rt_alloc → rt_malloc; rt.alloc → rt.malloc

Hare's canonical runtime allocator is rt::malloc with linker symbol
rt.malloc (ref/hare/rt/malloc.ha:27,78). ww kept the dot→underscore
Plan 9 convention (CLAUDE.md rule 4) so the linker symbol becomes
rt_malloc; the lib/rt exported function name becomes malloc; ww
callers say rt.malloc(...).

The language builtin keyword stays `alloc(T)!` — unchanged from Hare
(ref/hare/hare/lex/token.ha:21 ltok::ALLOC, parse/expr.ha:398
builtin()). The rename only touches the lowered linker symbol and the
exported function name behind it; the user-facing syntax for
heap-allocation is identical to Hare.

Surface:
- rt/alloc.s: TEXT rt_alloc → TEXT rt_malloc, labels updated
- lib/rt/malloc.ww: @symbol("rt_malloc") fn malloc(...) (was rt_alloc/alloc)
- rt/ensure.ww: local FFI decl + call site updated to malloc; `!` dropped
  on the direct FFI call (rt_malloc returns *void, not a tagged union)
- 18 .ww callers: rt.alloc(...) → rt.malloc(...)
- cstage cmd/wcc/check.c + wwstage selfhost/cmd/wcc/check.ww
  alloc-builtin suppression gate routes through ffi_resolve("malloc")
  for the lowering; the user-shadow check still keys on the BUILTIN
  KEYWORD "alloc" since that is what `alloc(...)` parses as. Adding
  "malloc" to the user-shadow check was unnecessary and was reverted
  during pre-commit review.
- cstage cmd/w6c/cgen.c: 2× ffi_resolve("alloc") → ffi_resolve("malloc")
- wwstage cgenexpr/cgenstmt: 2× ffiresolve(c, "alloc") → ffiresolve(c, "malloc")
- Test fixtures (700_e2e, 758_cgalloc_str_field, 990_selfhost, 992_w6l_ww,
  selfhost/test/tagged_ptr_ret.ww): updated inline ww sources to the new
  decl + call form

This is commit 2 of 3 in the lib/rt extraction (#38). Commit 3 closes
the OOM contract — return type becomes nullable *void and the builtin
lowering null-checks + propagates nomem.

Verified 132/132 + 995_self_rebuild byte-identity (5 wwstage tools
round-trip identical) + make clean cold rebuild.

selfhost/cmd/w6a/main.combined.ww

@@ -438,7 +438,7 @@ export fn getdents64(fd: i32, buf: *u8, n: u64) i64 = {
 
 // rt_envp — runtime-side getter. rt/start.s captures envp into a DATAW
 // slot before calling main; this binding lifts the captured pointer
-// into ww. Same FFI shape as rt_syscall / rt_alloc / rt_abort: a TEXT
+// into ww. Same FFI shape as rt_syscall / rt_malloc / rt_abort: a TEXT
 // symbol the linker resolves. The returned `**u8` is a NUL-terminated
 // table of `*u8` entries, each pointing at a NUL-terminated
 // "NAME=VALUE" byte sequence.
@@ -732,7 +732,7 @@ export fn exists(path: str) bool = {
 
 package rt;
 
-// alloc — mmap-backed page allocator. Untyped: `alloc(n)` returns a
+// malloc — mmap-backed page allocator. Untyped: `malloc(n)` returns a
 // `*void`; callers cast to the target type. Diverges from Hare: Hare
 // exposes `alloc` / `free` as typed language builtins that the
 // compiler lowers to rt::malloc/rt::free; ww has no such builtins,
@@ -740,20 +740,20 @@ package rt;
 // need a typed allocation pattern wrap this with a cast plus a stored
 // capacity (see [[strings.dup]], [[memio.dynamic]]).
 //
-// OOM: rt_alloc is a bare mmap(MAP_ANON|MAP_PRIVATE) wrapper with no
+// OOM: rt_malloc is a bare mmap(MAP_ANON|MAP_PRIVATE) wrapper with no
 // error path. The raw Linux mmap syscall returns a negative errno cast
 // to `*void` on failure (e.g. `(void*)-12` for ENOMEM); the
 // `MAP_FAILED` (`(void*)-1`) value is a libc-wrapper convention that
-// rt_alloc doesn't apply. Neither `== nil` nor `== (void*)-1` catches
+// rt_malloc doesn't apply. Neither `== nil` nor `== (void*)-1` catches
 // it; any deref of such a return faults. Today the stdlib does not
 // check; OOM faults on first dereference. A typed fallible variant is
 // a future task (task #39). ref/hare/rt/malloc.ha:27.
-@symbol("rt_alloc") export fn alloc(n: u64) *void;
+@symbol("rt_malloc") export fn malloc(n: u64) *void;
 
 // selfhost/cmd/wcc/mem.ww — port of cmd/wcc/mem.c.
 //
 // Bump arena allocator. Backed by the runtime page allocator
-// (rt_alloc / rt_free), no libc. Each chunk is mmap'd; when the
+// (rt_malloc / rt_free), no libc. Each chunk is mmap'd; when the
 // current chunk runs out we link a fresh one. Freeing the arena
 // unmaps the chain.
 //
@@ -783,8 +783,8 @@ fn roundup(n: u64, a: u64) u64 = {
 };
 
 export fn newarena() *arena = {
-	let a: *arena = rt.alloc(ARENA_SZ): *arena;
-	a.buf = rt.alloc(INIT_CHUNK): *u8;
+	let a: *arena = rt.malloc(ARENA_SZ): *arena;
+	a.buf = rt.malloc(INIT_CHUNK): *u8;
 	a.off = 0u64;
 	a.cap = INIT_CHUNK;
 	a.next = nil;
@@ -801,14 +801,14 @@ fn grow(a: *arena, need: u64) bool = {
 	if (want > MAX_CHUNK) { want = MAX_CHUNK; };
 	if (want < need) { return false; };	// single allocation too big
 
-	let old: *arena = rt.alloc(ARENA_SZ): *arena;
+	let old: *arena = rt.malloc(ARENA_SZ): *arena;
 	old.buf = a.buf;
 	old.off = a.off;
 	old.cap = a.cap;
 	old.next = a.next;
 	old.total = 0u64;
 
-	a.buf = rt.alloc(want): *u8;
+	a.buf = rt.malloc(want): *u8;
 	a.off = 0u64;
 	a.cap = want;
 	a.next = old;
@@ -1760,7 +1760,7 @@ export fn emitbyte(a: *asm_, b: u8) void = {
 		let nc: u64 = a.textcap;
 		if (nc == 0u64) { nc = 4096u64; };
 		nc = nc * 2u64;
-		let nb: *u8 = rt.alloc(nc): *u8;
+		let nb: *u8 = rt.malloc(nc): *u8;
 		let i: u64 = 0u64;
 		for (i < a.textlen) { nb[i] = a.text[i]; i += 1u64; };
 		a.text = nb;
@@ -1797,7 +1797,7 @@ export fn emitdatabyte(a: *asm_, b: u8) void = {
 		let nc: u64 = a.datacap;
 		if (nc == 0u64) { nc = 256u64; };
 		nc = nc * 2u64;
-		let nb: *u8 = rt.alloc(nc): *u8;
+		let nb: *u8 = rt.malloc(nc): *u8;
 		let i: u64 = 0u64;
 		for (i < a.datalen) { nb[i] = a.data[i]; i += 1u64; };
 		a.data = nb;
@@ -3058,7 +3058,7 @@ fn slurp(path: *u8) (*u8, u64) = {
 	case let e: os.oserror => { os.close(fd); return nil, 0u64; };
 	};
 	let nz: u64 = n: u64;
-	let buf: *u8 = rt.alloc(nz + 1u64): *u8;
+	let buf: *u8 = rt.malloc(nz + 1u64): *u8;
 	let rr: (i64 | os.oserror) = os.readall(fd, buf, nz);
 	os.close(fd);
 	let got: i64 = 0i64;