ww test: @test name-filter via fnmatch (both stages)

`ww test <file> <pattern>` runs only the @test fns whose names match the
fnmatch glob; no pattern runs all (byte-for-byte the pre-filter path);
zero matches prints "No tests run" and exits 0 (Hare ground truth
ref/hare/test/+test.ha:114-117). A pattern in directory mode is rejected
"ww test: pattern needs a single test file" (rc 2), identical wording in
both twins (cmd/ww/main.c do_test + selfhost/cmd/ww/main.ww dotest).

Mechanism (a): rt/start.s stashes argc/argv into rt_argc/rt_argv getters
(rt_envp twin shape, -T synth untouched so 990-997 byte-id holds);
lib/os.args() rebuilds the []str view, build-once-cached; lib/test/run.ww
imports fnmatch and filters av[1..] (argv[0] is the binary path). The
driver forwards the 2nd positional as argv[1] via fork/execv (cstage) /
procrun (wwstage) so glob metachars aren't shell-expanded.

os.args() is the first `alloc`-caller in the base os module, so os.ww now
imports rt — the `alloc` builtin's malloc lowers to rt_malloc only when
the rt binding is bundled (mirror lib/strings/strings.ww:30); without it a
plain `ww build` of any os-importing program links bare libc `malloc`
(undefined). os is bundled by ~every program, so this is load-bearing.

The lib/test floor rises os-only -> os+fnmatch+ascii+strings in every -T
build; the bundled `ascii` module vs a `@test fn ascii` collision that
exposed is closed by the preceding #30 promote commit. 989_test_filter
pins the full matrix on both twins byte-identically; 949 gains the
dir-mode reject row. (#17)

lib/test/run.ww

@@ -16,9 +16,29 @@ package test;
 //
 // D1/D4/D5 reductions also retained from the -T synth era: no
 // __test_array linker section (the synth hands us a value table), no
-// sort, no file:line reflection. fnmatch name-filtering is task #17
-// commit-3 (drew spec §d), not here.
+// sort, no file:line reflection.
+//
+// fnmatch NAME-FILTER (task #17 commit-3, drew spec §d): when the test
+// binary is invoked with trailing argv (the driver passes `ww test
+// <file> [pattern]` through as argv[1..]), each pattern is a shell glob
+// matched against the test name via [[fnmatch.fnmatch]]; a test runs iff
+// some pattern matches. No pattern (argv.len == 1) runs ALL tests — the
+// no-filter path is byte-for-byte the pre-filter behavior. Zero matches
+// prints "No tests run" and exits 0, mirroring Hare's __test_main
+// (ref/hare/test/+test.ha:104-117). The synth (`run(__wwtests)`) and the
+// value table are UNCHANGED — the pattern reaches us via os.args, so
+// 990-997 byte-id and the no-pattern path hold.
+//
+// BUNDLE-FLOOR CONSEQUENCE (sanctioned, task #17): importing fnmatch
+// raises lib/test's auto-bundle floor from os-only to
+// os+fnmatch+ascii+strings (+their transitive bytes/encoding.utf8/types/
+// rt) in EVERY -T build. fnmatch's module-private symbols co-bundle into
+// the same flat "" scope as the test's modules (pre-#8, no package
+// isolation); a same-named module-private fn in a tested module would
+// collide. Accepted as the cost of name-filtering; #8 (real packages)
+// retires it.
 
+import fnmatch;
 import os;
 
 // run — execute each test in `tests` in a forked subprocess, report a
@@ -41,30 +61,62 @@ import os;
 // rejects a duplicate fn, wwstage does not), so the collision is loud on
 // the reference stage but silent on wwstage until #23 lands.
 export fn run(tests: [](str, *fn() void)) i32 = {
+	let av: []str = os.args();
 	let nfail: i32 = 0;
+	let nrun: i32 = 0;
 	let i: i32 = 0;
 	for (i < tests.len) {
 		let row: (str, *fn() void) = tests[i];
 		let name: str = row.0;
 		let f: *fn() void = row.1;
-		tstputs(name);
-		tstputs(" ... ");
-		let st: i32 = tstrunone(f);
-		if (st == 0) {
-			tstputs("ok\n");
-		} else {
-			tstputs("FAIL\n");
-			nfail += 1;
+		if (tstenabled(name, av)) {
+			tstputs(name);
+			tstputs(" ... ");
+			let st: i32 = tstrunone(f);
+			if (st == 0) {
+				tstputs("ok\n");
+			} else {
+				tstputs("FAIL\n");
+				nfail += 1;
+			};
+			nrun += 1;
 		};
 		i += 1;
 	};
-	tstputuint(tests.len - nfail);
+	// Zero tests selected (an over-narrow pattern, or none matched): Hare
+	// prints "No tests run" and returns 0 regardless of whether a pattern
+	// was given (ref/hare/test/+test.ha:114-117).
+	if (nrun == 0) {
+		tstputs("No tests run\n");
+		return 0;
+	};
+	tstputuint(nrun - nfail);
 	tstputs(" passed, ");
 	tstputuint(nfail);
 	tstputs(" failed\n");
 	return nfail;
 };
 
+// tstenabled — does `name` pass the name-filter? `av` is os.args():
+// av[0] is the program name, av[1..] the glob patterns the driver
+// forwarded. No patterns (av.len <= 1) enables every test; otherwise a
+// test is enabled iff SOME pattern fnmatch-matches (Hare's OR-over-args,
+// ref/hare/test/+test.ha:106-113). DIVERGENCE: Hare iterates all of
+// os::args including [0]; ww skips [0] — the test binary path is never a
+// test-name pattern (the driver passes the pattern as the first
+// post-program arg, never argv[0]).
+fn tstenabled(name: str, av: []str) bool = {
+	if (av.len <= 1) { return true; };
+	let j: i32 = 1;
+	for (j < av.len) {
+		if (fnmatch.fnmatch(av[j], name, fnmatch.flag.NONE)) {
+			return true;
+		};
+		j += 1;
+	};
+	return false;
+};
+
 // runone — fork, run `f` in the child, decode the child's wait-status.
 // Byte-for-byte the procrun (main.ww:154-177) status decode: low 7 bits
 // are the killing signal (abort=SIGABRT, div0/SIGSEGV), 0 if the child