6l: port ET_DYN dynamic linking to the ww side

Ports cmd/6l/{dyn,dynout}.c into selfhost/cmd/6l/{dyn,dynout}.ww:
ET_DYN .so loading + PT_INTERP/PT_DYNAMIC ELF emission with .rela.plt,
.gnu.version_r, BIND_NOW. lsym grows dyn fields; pass.ww promotes
undefs to dyn; out.ww dispatches; main.ww takes -L/-l. The ww driver
forwards -L/-l to 6l_ww so 'ww_ww build snake.ww -L /usr/lib -l ncurses
-l c' runs without cc.

Test 996 pins byte-identical output to C-6l on snake.

'make bootstrap' gains a fourth stage with cmp ww3 == ww4, proving
ww3 is byte-stable when used as a compiler — not just a coincidental
two-stage equilibrium.

Four wwstage 6c cgen quirks surfaced and are documented in dynout.ww's
header (two-level field-write through a pointer field, (scalar, str)
tuple returns, def : str, ≤6 arg calling convention).

BOOTSTRAP.md

@@ -60,7 +60,9 @@ Phase 10 of `PLAN.md` is at its first exit criterion: the bootstrap is
 green and `selfhost/cmd/{wwc,6c,6a,6l,ww}` are byte-identical to their
 Cstage counterparts. Test 995 pins the stronger property — the
 wwstage rebuilds every one of its own tools through `ww_ww + 6c_ww +
-6a_ww + 6l_ww`, byte-for-byte.
+6a_ww + 6l_ww`, byte-for-byte. Test 996 pins the equivalent for the
+dynamic linker: `6l_ww` with `-L`/`-l` produces a byte-identical
+PT_INTERP+PT_DYNAMIC binary to C-side `6l` on snake.
 
 `make nocc` is wired and verifies stage-0 self-reproduction locally;
 the stage-0 binaries under `bootstrap/$(ARCH)/` are gitignored until