lib: extract rt module from os, sweep imports

Hare puts runtime allocation in rt::, not os:: (ref/hare/rt/malloc.ha:27,
README). ww's `@symbol("rt_alloc") fn alloc(n: u64) *void;` lived at
lib/os/os.ww as a historical bootstrap shortcut; this commit relocates
it to a new lib/rt/malloc.ww and sweeps every site that depended on
`import os` for the alloc decl over to `import rt`.

This is commit 1 of 3 in the lib/rt extraction (#35):
  1. (this) move decl, sweep imports — preserves shape
  2. rename rt_alloc → rt_malloc (#38)
  3. nullable return type + OOM-propagating builtin lowering (#39)

No rename here. Symbol stays rt_alloc, function stays `alloc`, return
stays *void. Behavior identical — same ffi resolution outcome, just
sourced from a different module file. The rt::ensure runtime helper at
selfhost/rt/ensure.ww is its own compilation unit with a local decl and
is untouched.

Side effect: every wcc cgen file used `rt` as a local *node variable
name for "return type." `import rt;` shadows the module, so each
selfhost/cmd/wcc/{check,cgenstmt,cgenexpr,cgenutil}.ww site renamed
to `rtyp`. Mechanical follow-through; only the wcc module-import was
forced to do this rename.

Verified 132/132 + 995_self_rebuild byte-identity (5 wwstage tools
round-trip byte-identical).

selfhost/cmd/w6a/asm.ww

@@ -12,6 +12,7 @@
 package w6a;
 
 import os;
+import rt;
 import mem;
 import types;
 
@@ -22,7 +23,7 @@ export fn emitbyte(a: *asm_, b: u8) void = {
 		let nc: u64 = a.textcap;
 		if (nc == 0u64) { nc = 4096u64; };
 		nc = nc * 2u64;
-		let nb: *u8 = os.alloc(nc): *u8;
+		let nb: *u8 = rt.alloc(nc): *u8;
 		let i: u64 = 0u64;
 		for (i < a.textlen) { nb[i] = a.text[i]; i += 1u64; };
 		a.text = nb;
@@ -59,7 +60,7 @@ export fn emitdatabyte(a: *asm_, b: u8) void = {
 		let nc: u64 = a.datacap;
 		if (nc == 0u64) { nc = 256u64; };
 		nc = nc * 2u64;
-		let nb: *u8 = os.alloc(nc): *u8;
+		let nb: *u8 = rt.alloc(nc): *u8;
 		let i: u64 = 0u64;
 		for (i < a.datalen) { nb[i] = a.data[i]; i += 1u64; };
 		a.data = nb;