rt: bump-over-mmap allocator (rt_segmalloc + rt_free no-op)

rt_malloc was a bare mmap-per-call wrapper: every allocation, even a
32-72B AST/symbol node, consumed a page-rounded 4KB region and was
never freed. w6a/w6c emit ~4 such nodes per .s line, so assembling a
145K-line file burned ~625K pages (~2.5GB); test 995's 5 concurrent
self-rebuilds then OOM'd. The defect is linear and str-independent --
the str->24B codegen merely enlarged .s files past the cliff.

Replace it with the no-free SUBSET of Hare's allocator
(ref/hare/rt/malloc.ha): 2MiB chunk-bump (CHUNKSZ malloc.ha:24, ALIGN
malloc.ha:14), oversized (>CHUNKSZ) requests direct-mmap'd. The
bin/freelist/META machinery exists only to support free, which ww does
not have, so it is omitted. Policy lives in rt/malloc.ww; the raw mmap
primitive stays in rt/alloc.s as rt_segmalloc -- Hare's malloc/segmalloc
split.

rt_free becomes a documented no-op (os.free re-exports it for the public
API, so the symbol must stay); rt/ensure.ww drops its now-impossible
reclaim. Zero-init is preserved: the bump never reuses memory, so every
byte is fresh MAP_ANONYMOUS-zeroed.

w6a_ww on a 145K-line .s: 2165MB -> 28MB (~glibc parity, C w6a 24MB).
.o output byte-identical; both stages emit identical asm. make test
134/134.

rt/alloc.s

@@ -1,18 +1,18 @@
-// rt/alloc.s — page allocator via the mmap syscall.
+// rt/alloc.s — raw page primitive via the mmap syscall.
 //
-// rt_malloc(n: u64) returns a *void aligned at a page boundary, sized
-// to the next page multiple. Pair with rt_free(p, n).
+// rt_segmalloc(n: u64) returns a *void aligned at a page boundary, sized
+// to the next page multiple. It is the primitive under rt/malloc.ww's
+// bump allocator (renamed from rt_malloc, task #8) — callers use the
+// bump rt_malloc, not this directly.
 //
 // We pin to PROT_READ|PROT_WRITE and MAP_PRIVATE|MAP_ANONYMOUS so
 // callers never have to plumb file descriptors through.
 //
-// On mmap failure the raw syscall returns -errno (negative). Task #30
-// graduated the `alloc` builtin to a fallible `(*T | nomem)` /
-// `([]T | nomem)` signature whose cgen branches on a null return, so
-// the failure path here returns 0 instead of a poisoned pointer. The
-// builtin's caller is expected to `!`/`?` the result.
+// On mmap failure the raw syscall returns -errno (negative); we map
+// that to 0 so the bump allocator's null-check (and the alloc builtin's
+// `!`/`?` lowering, task #30) sees a clean nil.
 
-TEXT rt_malloc,$0
+TEXT rt_segmalloc,$0
 	MOVQ	DI, SI		// arg 1: length = caller's n
 	MOVQ	$0, DI		// arg 0: addr = NULL (kernel chooses)
 	MOVQ	$3, DX		// arg 2: prot = R|W
@@ -22,13 +22,15 @@ TEXT rt_malloc,$0
 	MOVQ	$9, AX		// syscall: mmap
 	SYSCALL
 	CMPQ	$0, AX
-	JGE	rt_malloc_ok
+	JGE	rt_segmalloc_ok
 	XORQ	AX, AX
-rt_malloc_ok:
+rt_segmalloc_ok:
 	RET
 
+// rt_free is a no-op: ww is a no-free runtime. rt/malloc.ww bumps over
+// shared 2MiB chunks, so a mid-chunk pointer cannot be unmapped without
+// corrupting its neighbours; all memory is reclaimed at process exit.
+// Kept as a symbol because os.free re-exports it (lib/os/os.ww) for the
+// public API — callers' frees become harmless leaks. (task #8)
 TEXT rt_free,$0
-	// DI already holds ptr, SI already holds length
-	MOVQ	$11, AX		// syscall: munmap
-	SYSCALL
 	RET