lib: extract rt module from os, sweep imports

Hare puts runtime allocation in rt::, not os:: (ref/hare/rt/malloc.ha:27,
README). ww's `@symbol("rt_alloc") fn alloc(n: u64) *void;` lived at
lib/os/os.ww as a historical bootstrap shortcut; this commit relocates
it to a new lib/rt/malloc.ww and sweeps every site that depended on
`import os` for the alloc decl over to `import rt`.

This is commit 1 of 3 in the lib/rt extraction (#35):
  1. (this) move decl, sweep imports — preserves shape
  2. rename rt_alloc → rt_malloc (#38)
  3. nullable return type + OOM-propagating builtin lowering (#39)

No rename here. Symbol stays rt_alloc, function stays `alloc`, return
stays *void. Behavior identical — same ffi resolution outcome, just
sourced from a different module file. The rt::ensure runtime helper at
selfhost/rt/ensure.ww is its own compilation unit with a local decl and
is untouched.

Side effect: every wcc cgen file used `rt` as a local *node variable
name for "return type." `import rt;` shadows the module, so each
selfhost/cmd/wcc/{check,cgenstmt,cgenexpr,cgenutil}.ww site renamed
to `rtyp`. Mechanical follow-through; only the wcc module-import was
forced to do this rename.

Verified 132/132 + 995_self_rebuild byte-identity (5 wwstage tools
round-trip byte-identical).

lib/fmt/fmt.ww

@@ -29,6 +29,7 @@ package fmt;
 import io;
 import memio;
 import os;
+import rt;
 import strconv;
 
 // i64dec_buf — scratch buffer for [[i64dec]] below. Module-level
@@ -885,7 +886,7 @@ export fn asprintf(fmt: str, args: field...) str = {
 		match (cres) { case void => {}; case io.closed => {}; };
 		return out;
 	};
-	let tight: *u8 = os.alloc(view.len: u64): *u8;
+	let tight: *u8 = rt.alloc(view.len: u64): *u8;
 	let i: i32 = 0;
 	for (i < view.len) {
 		tight[i] = view.ptr[i];

lib/memio/memio.ww

@@ -30,6 +30,7 @@ package memio;
 
 import io;
 import os;
+import rt;
 
 // state — memio's per-stream bookkeeping. The caller owns the slot
 // and passes its address into a constructor. `ptr/len/cap` are the
@@ -196,7 +197,7 @@ fn grow(m: *state, need: i32) void = {
 	let newcap: i32 = m.cap;
 	if (newcap < 8) { newcap = 8; };
 	for (newcap < need) { newcap *= 2; };
-	let nbuf: *u8 = os.alloc(newcap: u64): *u8;
+	let nbuf: *u8 = rt.alloc(newcap: u64): *u8;
 	let i: i32 = 0;
 	for (i < m.len) {
 		nbuf[i] = m.ptr[i];

lib/os/os.ww

@@ -12,28 +12,6 @@ import time;
 @symbol("rt_syscall") fn syscall3(num: nr, a: i64, b: i64, c: i64) i64;
 @symbol("rt_syscall") fn syscall4(num: nr, a: i64, b: i64, c: i64, d: i64) i64;
 
-// alloc / free — runtime mmap-backed page allocator. Untyped:
-// `alloc(n)` returns a `*void` and `free(p, n)` requires the byte
-// count back because rt_free is munmap-based and doesn't track
-// mapping sizes (the kernel needs the length to release the
-// reservation).
-//
-// Diverges from Hare. Hare exposes `alloc` / `free` as typed
-// language builtins (`alloc(value, cap)?` / `free(ptr)`) that the
-// compiler lowers to rt::malloc/rt::free; ww has no such builtins,
-// so the rt-symbol surface is exposed directly. Stdlib callers
-// that need a typed allocation pattern wrap this with a cast plus
-// a stored capacity (see [[strings.dup]], [[memio.dynamic]]).
-//
-// OOM: rt_alloc is a bare mmap(MAP_ANON|MAP_PRIVATE) wrapper with
-// no error path. The raw Linux mmap syscall returns a negative
-// errno cast to `*void` on failure (e.g. `(void*)-12` for ENOMEM);
-// the `MAP_FAILED` (`(void*)-1`) value is a libc-wrapper convention
-// that rt_alloc doesn't apply. Neither `== nil` nor `== (void*)-1`
-// catches it; any deref of such a return faults. Today the stdlib
-// does not check; OOM faults on first dereference. A typed
-// fallible variant is a future task.
-@symbol("rt_alloc") export fn alloc(n: u64) *void;
 @symbol("rt_free")  export fn free(p: *void, n: u64) void;
 @symbol("rt_abort") fn abort(msg: str) void;
 

lib/os/ostest.ww

@@ -26,6 +26,7 @@
 package os;
 
 import os;
+import rt;
 
 let signalled: i32 = 0;
 
@@ -102,7 +103,7 @@ fn streq(a: str, b: str) bool = {
 // dereferenceable, not just non-nil).
 
 @test fn test_alloc_free_roundtrip() void = {
-	let p: *u8 = os.alloc(4096u64): *u8;
+	let p: *u8 = rt.alloc(4096u64): *u8;
 	if (p == nil: *u8) { fail(); };
 	// Write a sentinel at the head and tail of the page, read it
 	// back. A miscompiled binding (wrong arg order, wrong ABI, etc.)

lib/path/path.ww

@@ -5,7 +5,7 @@
 
 package path;
 
-import os;
+import rt;
 
 def SEP: u8 = 47u8;	// '/'
 
@@ -95,7 +95,7 @@ export fn extension(p: str) str = {
 // two-arg join (no variadic).
 export fn join(a: str, b: str) str = {
 	if (abs(b)) {
-		let buf: *u8 = os.alloc(b.len: u64): *u8;
+		let buf: *u8 = rt.alloc(b.len: u64): *u8;
 		let i: i32 = 0;
 		for (i < b.len) { buf[i] = b[i]; i += 1; };
 		let r: str;
@@ -104,7 +104,7 @@ export fn join(a: str, b: str) str = {
 		return r;
 	};
 	if (a.len == 0) {
-		let buf: *u8 = os.alloc(b.len: u64): *u8;
+		let buf: *u8 = rt.alloc(b.len: u64): *u8;
 		let i: i32 = 0;
 		for (i < b.len) { buf[i] = b[i]; i += 1; };
 		let r: str;
@@ -113,7 +113,7 @@ export fn join(a: str, b: str) str = {
 		return r;
 	};
 	if (b.len == 0) {
-		let buf: *u8 = os.alloc(a.len: u64): *u8;
+		let buf: *u8 = rt.alloc(a.len: u64): *u8;
 		let i: i32 = 0;
 		for (i < a.len) { buf[i] = a[i]; i += 1; };
 		let r: str;
@@ -129,7 +129,7 @@ export fn join(a: str, b: str) str = {
 		an -= 1;
 	};
 	let total: i32 = an + 1 + b.len;
-	let buf: *u8 = os.alloc(total: u64): *u8;
+	let buf: *u8 = rt.alloc(total: u64): *u8;
 	let i: i32 = 0;
 	for (i < an) { buf[i] = a[i]; i += 1; };
 	buf[an] = SEP;

lib/rt/malloc.ww

@@ -0,0 +1,22 @@
+// rt — runtime primitives exposed to ww programs.
+// Mirrors Hare's rt:: module placement (ref/hare/rt/).
+
+package rt;
+
+// alloc — mmap-backed page allocator. Untyped: `alloc(n)` returns a
+// `*void`; callers cast to the target type. Diverges from Hare: Hare
+// exposes `alloc` / `free` as typed language builtins that the
+// compiler lowers to rt::malloc/rt::free; ww has no such builtins,
+// so the rt-symbol surface is exposed directly. Stdlib callers that
+// need a typed allocation pattern wrap this with a cast plus a stored
+// capacity (see [[strings.dup]], [[memio.dynamic]]).
+//
+// OOM: rt_alloc is a bare mmap(MAP_ANON|MAP_PRIVATE) wrapper with no
+// error path. The raw Linux mmap syscall returns a negative errno cast
+// to `*void` on failure (e.g. `(void*)-12` for ENOMEM); the
+// `MAP_FAILED` (`(void*)-1`) value is a libc-wrapper convention that
+// rt_alloc doesn't apply. Neither `== nil` nor `== (void*)-1` catches
+// it; any deref of such a return faults. Today the stdlib does not
+// check; OOM faults on first dereference. A typed fallible variant is
+// a future task (task #39). ref/hare/rt/malloc.ha:27.
+@symbol("rt_alloc") export fn alloc(n: u64) *void;

lib/shlex/shlex.ww

@@ -97,6 +97,7 @@ package shlex;
 import io;
 import memio;
 import os;
+import rt;
 
 // rt_ensure is the runtime slice-growth helper invoked by the
 // `append(s, v)` builtin. We bind it directly because the builtin's
@@ -125,7 +126,7 @@ fn dupstr(s: str) str = {
 	r.ptr = nil;
 	r.len = 0;
 	if (s.len == 0) { return r; };
-	let buf: *u8 = os.alloc(s.len: u64): *u8;
+	let buf: *u8 = rt.alloc(s.len: u64): *u8;
 	let i: i32 = 0;
 	for (i < s.len) { buf[i] = s[i]; i += 1; };
 	r.ptr = buf;

lib/strings/strings.ww

@@ -27,6 +27,7 @@ package strings;
 import bytes;
 import encoding.utf8;
 import os;
+import rt;
 import types;
 
 // toutf8 — borrowed []u8 view of `s`. ref/hare/strings/utf8.ha:29.
@@ -98,7 +99,7 @@ export fn dup(s: str) str = {
 	r.ptr = nil;
 	r.len = 0;
 	if (s.len == 0) { return r; };
-	let buf: *u8 = os.alloc(s.len: u64): *u8;
+	let buf: *u8 = rt.alloc(s.len: u64): *u8;
 	let i: i32 = 0;
 	for (i < s.len) { buf[i] = s[i]; i += 1; };
 	r.ptr = buf;
@@ -176,7 +177,7 @@ export fn concat(strs: str...) str = {
 	r.ptr = nil;
 	r.len = 0;
 	if (total == 0) { return r; };
-	let buf: *u8 = os.alloc(total: u64): *u8;
+	let buf: *u8 = rt.alloc(total: u64): *u8;
 	let off: i32 = 0;
 	i = 0;
 	for (i < strs.len) {
@@ -209,7 +210,7 @@ export fn join(delim: str, strs: str...) str = {
 	r.ptr = nil;
 	r.len = 0;
 	if (total == 0) { return r; };
-	let buf: *u8 = os.alloc(total: u64): *u8;
+	let buf: *u8 = rt.alloc(total: u64): *u8;
 	let off: i32 = 0;
 	i = 0;
 	for (i < strs.len) {
@@ -886,7 +887,7 @@ export fn lpad(s: str, p: rune, maxlen: i32) str = {
 	if (s.len >= maxlen) { return dup(s); };
 	let scratch: [4]u8;
 	let pad: []u8 = runebytes(scratch[0:4], p);
-	let buf: *u8 = os.alloc(maxlen: u64): *u8;
+	let buf: *u8 = rt.alloc(maxlen: u64): *u8;
 	let padwrite: i32 = (maxlen - s.len) * pad.len;
 	if (padwrite > maxlen) { padwrite = maxlen; };
 	let off: i32 = 0;
@@ -969,7 +970,7 @@ export fn rpad(s: str, p: rune, maxlen: i32) str = {
 	if (s.len >= maxlen) { return dup(s); };
 	let scratch: [4]u8;
 	let pad: []u8 = runebytes(scratch[0:4], p);
-	let buf: *u8 = os.alloc(maxlen: u64): *u8;
+	let buf: *u8 = rt.alloc(maxlen: u64): *u8;
 	let k: i32 = 0;
 	for (k < s.len) {
 		buf[k] = s[k];