wcc: -T test-mode collects @test fns + synthesizes entry, both stages (#15)

@test was parsed then dropped (no consumer); `ww test` needed a hand-written
main listing each test by hand, so adding a @test and forgetting the call
silently skipped it. -T makes the checker collect @test N_FNDECLs in source
order, loud-reject a user main, and append a synthetic
`export fn main() i32 { t0(); ...; return 0; }` at the install->body-check seam;
the existing cgfn emits it (cgen untouched) -> byte-identical by construction.
Mirrors harec's checker-side is_test placement.

Plan-9-lean reduction (user-sanctioned, reinstatable post-CSP): sequential,
abort/nonzero=fail; no setjmp isolation, no fnmatch filter, no file:line.

910/997 rewired from a regex scanner to driving `w6c -T` directly (thin trusted
drivers; the @test content stays ww), with a cross-stage byte-id assert on the
-T output. attest_userman/attest_badsig pin the user-main and bad-signature
rejects.

cmd/wcc/ww.h

@@ -555,6 +555,8 @@ struct Checker {
 			 * would shadow an imported module bareword. */
 	int	loops;	/* nesting count for break/continue */
 	int	errs;
+	int	is_test;	/* #15: `w6c -T` — collect @test fns + synth
+				 * the entry; loud-reject a user main. */
 	Node	*alloc_octx;	/* #3/B': the one empty `alloc([], n)` call node
 				 * that has let-declared slice context this walk;
 				 * any OTHER empty alloc has no element-type hint