w6l+selfhost: dynamic-link + .data — shared R+W segment

.data now lives at the end of the dyn-path R+W PT_LOAD, just after
.dynamic. The single segment covers .got.plt + .dynamic + .data; its
filesz drops trailing zeros (BSS) while memsz spans the full extent.

Relocation moves from main.c into each emit function so the static
and dynamic paths use their own data_va — text→data refs land on the
right VA regardless of path. Removes the early-error in dynout.c
that previously refused any .data with -l/-L.

Tests: 810_dyn gains two new dyn+.data fixtures (mutable read+write
of an i32, plus a zero-init i64 verifying the BSS scan still produces
a valid p_filesz<p_memsz under the shared segment).

test/wcc/810_dyn.c

@@ -76,6 +76,28 @@ static const struct row rows[] = {
 	  "  return 0;\n"
 	  "};", 5 },
 
+	/* 5. Writable global on the dyn-link path. .data now lives in the
+	 * shared R+W segment with .got.plt and .dynamic; read and write
+	 * exercise the new layout's data_va. */
+	{ "@symbol(\"_exit\") fn libc_exit(c: i32) void;\n"
+	  "let counter: i32 = 0;\n"
+	  "export fn main() i32 = {\n"
+	  "  counter = 11;\n"
+	  "  libc_exit(counter);\n"
+	  "  return 0;\n"
+	  "};", 11 },
+
+	/* 6. Zero-init slot under dyn-link: the BSS trailing-zero scan
+	 * should still produce a valid p_filesz<p_memsz layout when the
+	 * R+W segment is the shared gotplt+dynamic+.data one. */
+	{ "@symbol(\"_exit\") fn libc_exit(c: i32) void;\n"
+	  "let z: i64;\n"
+	  "export fn main() i32 = {\n"
+	  "  z = 9i64;\n"
+	  "  libc_exit(z: i32);\n"
+	  "  return 0;\n"
+	  "};", 9 },
+
 	{ NULL, 0 }
 };