lib: extract rt module from os, sweep imports

Hare puts runtime allocation in rt::, not os:: (ref/hare/rt/malloc.ha:27,
README). ww's `@symbol("rt_alloc") fn alloc(n: u64) *void;` lived at
lib/os/os.ww as a historical bootstrap shortcut; this commit relocates
it to a new lib/rt/malloc.ww and sweeps every site that depended on
`import os` for the alloc decl over to `import rt`.

This is commit 1 of 3 in the lib/rt extraction (#35):
  1. (this) move decl, sweep imports — preserves shape
  2. rename rt_alloc → rt_malloc (#38)
  3. nullable return type + OOM-propagating builtin lowering (#39)

No rename here. Symbol stays rt_alloc, function stays `alloc`, return
stays *void. Behavior identical — same ffi resolution outcome, just
sourced from a different module file. The rt::ensure runtime helper at
selfhost/rt/ensure.ww is its own compilation unit with a local decl and
is untouched.

Side effect: every wcc cgen file used `rt` as a local *node variable
name for "return type." `import rt;` shadows the module, so each
selfhost/cmd/wcc/{check,cgenstmt,cgenexpr,cgenutil}.ww site renamed
to `rtyp`. Mechanical follow-through; only the wcc module-import was
forced to do this rename.

Verified 132/132 + 995_self_rebuild byte-identity (5 wwstage tools
round-trip byte-identical).

lib/rt/malloc.ww

@@ -0,0 +1,22 @@
+// rt — runtime primitives exposed to ww programs.
+// Mirrors Hare's rt:: module placement (ref/hare/rt/).
+
+package rt;
+
+// alloc — mmap-backed page allocator. Untyped: `alloc(n)` returns a
+// `*void`; callers cast to the target type. Diverges from Hare: Hare
+// exposes `alloc` / `free` as typed language builtins that the
+// compiler lowers to rt::malloc/rt::free; ww has no such builtins,
+// so the rt-symbol surface is exposed directly. Stdlib callers that
+// need a typed allocation pattern wrap this with a cast plus a stored
+// capacity (see [[strings.dup]], [[memio.dynamic]]).
+//
+// OOM: rt_alloc is a bare mmap(MAP_ANON|MAP_PRIVATE) wrapper with no
+// error path. The raw Linux mmap syscall returns a negative errno cast
+// to `*void` on failure (e.g. `(void*)-12` for ENOMEM); the
+// `MAP_FAILED` (`(void*)-1`) value is a libc-wrapper convention that
+// rt_alloc doesn't apply. Neither `== nil` nor `== (void*)-1` catches
+// it; any deref of such a return faults. Today the stdlib does not
+// check; OOM faults on first dereference. A typed fallible variant is
+// a future task (task #39). ref/hare/rt/malloc.ha:27.
+@symbol("rt_alloc") export fn alloc(n: u64) *void;