lib/rt: rename rt_alloc → rt_malloc; rt.alloc → rt.malloc

Hare's canonical runtime allocator is rt::malloc with linker symbol
rt.malloc (ref/hare/rt/malloc.ha:27,78). ww kept the dot→underscore
Plan 9 convention (CLAUDE.md rule 4) so the linker symbol becomes
rt_malloc; the lib/rt exported function name becomes malloc; ww
callers say rt.malloc(...).

The language builtin keyword stays `alloc(T)!` — unchanged from Hare
(ref/hare/hare/lex/token.ha:21 ltok::ALLOC, parse/expr.ha:398
builtin()). The rename only touches the lowered linker symbol and the
exported function name behind it; the user-facing syntax for
heap-allocation is identical to Hare.

Surface:
- rt/alloc.s: TEXT rt_alloc → TEXT rt_malloc, labels updated
- lib/rt/malloc.ww: @symbol("rt_malloc") fn malloc(...) (was rt_alloc/alloc)
- rt/ensure.ww: local FFI decl + call site updated to malloc; `!` dropped
  on the direct FFI call (rt_malloc returns *void, not a tagged union)
- 18 .ww callers: rt.alloc(...) → rt.malloc(...)
- cstage cmd/wcc/check.c + wwstage selfhost/cmd/wcc/check.ww
  alloc-builtin suppression gate routes through ffi_resolve("malloc")
  for the lowering; the user-shadow check still keys on the BUILTIN
  KEYWORD "alloc" since that is what `alloc(...)` parses as. Adding
  "malloc" to the user-shadow check was unnecessary and was reverted
  during pre-commit review.
- cstage cmd/w6c/cgen.c: 2× ffi_resolve("alloc") → ffi_resolve("malloc")
- wwstage cgenexpr/cgenstmt: 2× ffiresolve(c, "alloc") → ffiresolve(c, "malloc")
- Test fixtures (700_e2e, 758_cgalloc_str_field, 990_selfhost, 992_w6l_ww,
  selfhost/test/tagged_ptr_ret.ww): updated inline ww sources to the new
  decl + call form

This is commit 2 of 3 in the lib/rt extraction (#38). Commit 3 closes
the OOM contract — return type becomes nullable *void and the builtin
lowering null-checks + propagates nomem.

Verified 132/132 + 995_self_rebuild byte-identity (5 wwstage tools
round-trip identical) + make clean cold rebuild.

selfhost/cmd/w6l/main.ww

@@ -64,7 +64,7 @@ fn appenddec(dst: *u8, i: u64, n: u64) u64 = {
 		dst[i] = 48u8;
 		return i + 1u64;
 	};
-	let buf: *u8 = rt.alloc(16u64): *u8;
+	let buf: *u8 = rt.malloc(16u64): *u8;
 	let k: u64 = 0u64;
 	let v: u64 = n;
 	for (v > 0u64) {
@@ -103,7 +103,7 @@ fn buildpathv(dst: *u8, dir: *u8, name: *u8, v: u64) u64 = {
 fn islinkable(path: *u8) bool = {
 	let fd: i32 = os.open(pathstr(path), os.flag.RDONLY, 0i32);
 	if (fd < 0) { return false; };
-	let mp: *u8 = rt.alloc(8u64): *u8;
+	let mp: *u8 = rt.malloc(8u64): *u8;
 	let n: i64 = os.read(fd, mp, 8u64);
 	os.close(fd);
 	if (n < 4i64) { return false; };
@@ -131,7 +131,7 @@ fn islinkable(path: *u8) bool = {
 // then lib<name>.a. Return arena-owned NUL-terminated path on success,
 // nil on miss.
 fn resolvelib(a: *arena, name: *u8, libdirs: **u8, nlibdirs: i32) *u8 = {
-	let bufp: *u8 = rt.alloc(1024u64): *u8;
+	let bufp: *u8 = rt.malloc(1024u64): *u8;
 	let i: i32 = 0;
 	for (i < nlibdirs) {
 		let dir: *u8 = libdirs[i];
@@ -172,7 +172,7 @@ fn resolvelib(a: *arena, name: *u8, libdirs: **u8, nlibdirs: i32) *u8 = {
 fn isso(path: *u8) i32 = {
 	let fd: i32 = os.open(pathstr(path), os.flag.RDONLY, 0i32);
 	if (fd < 0) { return 0; };
-	let mp: *u8 = rt.alloc(20u64): *u8;
+	let mp: *u8 = rt.malloc(20u64): *u8;
 	let n: i64 = os.read(fd, mp, 20u64);
 	os.close(fd);
 	if (n < 20i64) { return 0; };
@@ -189,11 +189,11 @@ fn isso(path: *u8) i32 = {
 export fn main(argc: i32, argv: **u8) i32 = {
 	let outpath: *u8 = nil;
 	let maxinputs: i32 = 64;
-	let inputs:  **u8 = rt.alloc((maxinputs: u64) * 8u64): **u8;
+	let inputs:  **u8 = rt.malloc((maxinputs: u64) * 8u64): **u8;
 	let ninputs: i32 = 0;
-	let libdirs: **u8 = rt.alloc((maxinputs: u64) * 8u64): **u8;
+	let libdirs: **u8 = rt.malloc((maxinputs: u64) * 8u64): **u8;
 	let nlibdirs: i32 = 0;
-	let lflags:  **u8 = rt.alloc((maxinputs: u64) * 8u64): **u8;
+	let lflags:  **u8 = rt.malloc((maxinputs: u64) * 8u64): **u8;
 	let nlflags: i32 = 0;
 
 	let i: i32 = 1;