6l: port ET_DYN dynamic linking to the ww side

Ports cmd/6l/{dyn,dynout}.c into selfhost/cmd/6l/{dyn,dynout}.ww:
ET_DYN .so loading + PT_INTERP/PT_DYNAMIC ELF emission with .rela.plt,
.gnu.version_r, BIND_NOW. lsym grows dyn fields; pass.ww promotes
undefs to dyn; out.ww dispatches; main.ww takes -L/-l. The ww driver
forwards -L/-l to 6l_ww so 'ww_ww build snake.ww -L /usr/lib -l ncurses
-l c' runs without cc.

Test 996 pins byte-identical output to C-6l on snake.

'make bootstrap' gains a fourth stage with cmp ww3 == ww4, proving
ww3 is byte-stable when used as a compiler — not just a coincidental
two-stage equilibrium.

Four wwstage 6c cgen quirks surfaced and are documented in dynout.ww's
header (two-level field-write through a pointer field, (scalar, str)
tuple returns, def : str, ≤6 arg calling convention).

test/wwc/996_dyn_ww.c

@@ -0,0 +1,122 @@
+/*
+ * 996_dyn_ww — phase-8 marker for ET_DYN linking on the ww side.
+ *
+ * Drives 6l_ww with -L/-l flags over examples/snake/snake.o and diffs
+ * the result against the C-built 6l on the same inputs. A green run
+ * means the ww-side linker emits PT_INTERP/PT_DYNAMIC binaries byte-
+ * for-byte identical to the C linker — i.e. the dynamic linking story
+ * is fully ported and snake no longer depends on Cstage.
+ */
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
+#include <sys/wait.h>
+
+static int
+runwait(const char *cmd)
+{
+	int rc = system(cmd);
+	if (rc == -1) return -1;
+	if (WIFEXITED(rc)) return WEXITSTATUS(rc);
+	return 1;
+}
+
+static const char *
+absbin(void)
+{
+	const char *b = getenv("BIN");
+	if (!b) b = "out/bin";
+	if (b[0] == '/') return b;
+	static char buf[2048];
+	char cwd[1024];
+	if (getcwd(cwd, sizeof cwd) == NULL) return NULL;
+	snprintf(buf, sizeof buf, "%s/%s", cwd, b);
+	return buf;
+}
+
+static int
+slurp(const char *path, char **outbuf, size_t *outlen)
+{
+	FILE *f = fopen(path, "rb");
+	if (!f) return -1;
+	fseek(f, 0, SEEK_END);
+	long n = ftell(f);
+	fseek(f, 0, SEEK_SET);
+	if (n < 0) { fclose(f); return -1; }
+	char *b = malloc((size_t)n + 1);
+	if (!b) { fclose(f); return -1; }
+	if (fread(b, 1, (size_t)n, f) != (size_t)n) { free(b); fclose(f); return -1; }
+	b[n] = '\0';
+	fclose(f);
+	*outbuf = b;
+	*outlen = (size_t)n;
+	return 0;
+}
+
+int
+main(void)
+{
+	const char *bin = absbin();
+	if (!bin) return 1;
+
+	char cwd[1024];
+	if (getcwd(cwd, sizeof cwd) == NULL) return 1;
+
+	/* Ensure snake.o exists. The example's Makefile produces it via
+	 * the C-side `ww build`. Re-run that so the test is self-contained. */
+	char cmd[4096];
+	snprintf(cmd, sizeof cmd,
+	    "cd %s/examples/snake && %s/ww build snake.ww -L /usr/lib "
+	    "-l ncurses -l c >/dev/null 2>&1",
+	    cwd, bin);
+	if (runwait(cmd) != 0) {
+		fprintf(stderr, "6l_ww-dyn FAIL: cannot build snake.o via C driver\n");
+		return 1;
+	}
+
+	char co[64], wo[64];
+	snprintf(co, sizeof co, "/tmp/wwld_%d_c", getpid());
+	snprintf(wo, sizeof wo, "/tmp/wwld_%d_w", getpid());
+
+	/* C-side 6l with the dynamic flags. */
+	snprintf(cmd, sizeof cmd,
+	    "%s/6l -o %s %s/examples/snake/snake.o -L /usr/lib "
+	    "-l ncurses -l c %s/out/lib/libwwrt.a 2>/dev/null",
+	    bin, co, cwd, cwd);
+	if (runwait(cmd) != 0) {
+		fprintf(stderr, "6l_ww-dyn FAIL: C 6l errored\n");
+		unlink(co);
+		return 1;
+	}
+
+	/* ww-side 6l with the same flags. */
+	snprintf(cmd, sizeof cmd,
+	    "%s/6l_ww -o %s %s/examples/snake/snake.o -L /usr/lib "
+	    "-l ncurses -l c %s/out/lib/libwwrt.a 2>/dev/null",
+	    bin, wo, cwd, cwd);
+	if (runwait(cmd) != 0) {
+		fprintf(stderr, "6l_ww-dyn FAIL: ww 6l errored\n");
+		unlink(co); unlink(wo);
+		return 1;
+	}
+
+	char *bc = NULL, *bw = NULL;
+	size_t nc = 0, nw = 0;
+	int rc = 0;
+	if (slurp(co, &bc, &nc) < 0 || slurp(wo, &bw, &nw) < 0) {
+		fprintf(stderr, "6l_ww-dyn FAIL: cannot read outputs\n");
+		rc = 1;
+	} else if (nc != nw || memcmp(bc, bw, nc) != 0) {
+		fprintf(stderr, "6l_ww-dyn FAIL: C %zu vs ww %zu bytes\n",
+		    nc, nw);
+		rc = 1;
+	} else {
+		printf("6l_ww-dyn: byte-identical to C 6l on snake "
+		    "(PT_INTERP + PT_DYNAMIC + .rela.plt + .gnu.version_r, "
+		    "%zu bytes)\n", nc);
+	}
+	free(bc); free(bw);
+	unlink(co); unlink(wo);
+	return rc;
+}