rt: bump-over-mmap allocator (rt_segmalloc + rt_free no-op)

rt_malloc was a bare mmap-per-call wrapper: every allocation, even a
32-72B AST/symbol node, consumed a page-rounded 4KB region and was
never freed. w6a/w6c emit ~4 such nodes per .s line, so assembling a
145K-line file burned ~625K pages (~2.5GB); test 995's 5 concurrent
self-rebuilds then OOM'd. The defect is linear and str-independent --
the str->24B codegen merely enlarged .s files past the cliff.

Replace it with the no-free SUBSET of Hare's allocator
(ref/hare/rt/malloc.ha): 2MiB chunk-bump (CHUNKSZ malloc.ha:24, ALIGN
malloc.ha:14), oversized (>CHUNKSZ) requests direct-mmap'd. The
bin/freelist/META machinery exists only to support free, which ww does
not have, so it is omitted. Policy lives in rt/malloc.ww; the raw mmap
primitive stays in rt/alloc.s as rt_segmalloc -- Hare's malloc/segmalloc
split.

rt_free becomes a documented no-op (os.free re-exports it for the public
API, so the symbol must stay); rt/ensure.ww drops its now-impossible
reclaim. Zero-init is preserved: the bump never reuses memory, so every
byte is fresh MAP_ANONYMOUS-zeroed.

w6a_ww on a 145K-line .s: 2165MB -> 28MB (~glibc parity, C w6a 24MB).
.o output byte-identical; both stages emit identical asm. make test
134/134.

Makefile

@@ -39,7 +39,7 @@ W6L_SRC	= cmd/w6l/main.c cmd/w6l/obj.c cmd/w6l/sym.c cmd/w6l/pass.c cmd/w6l/out.
 W6L_OBJ	= $(W6L_SRC:cmd/w6l/%.c=$(OBJ)/w6l/%.o)
 
 RT_S	= rt/start.s rt/syscall.s rt/alloc.s rt/streq.s rt/abort.s
-RT_WW	= rt/ensure.ww
+RT_WW	= rt/ensure.ww rt/malloc.ww
 RT_OBJ	= $(RT_S:rt/%.s=$(OBJ)/rt/%.o) $(RT_WW:rt/%.ww=$(OBJ)/rt/%.o)
 
 # Cstage: one-time C bootstrap (see BOOTSTRAP.md). Built by `cc`.