cmd: α/γ-3 rt.malloc → alloc([], N)! (ww/wwdump main)

Phase 0 #8 third α/γ-batch. 33 sites total: 32 in selfhost/cmd/ww/
main.ww (driver) — 22 α `*u8` byte buffers + 10 γ `**u8` pointer
arrays — and 1 α in selfhost/cmd/wwdump/main.ww (file-slurp buffer,
previously amalloc).

Patterns:
- α: `let buf: []u8 = alloc([], N: u64)!; buf.len = N: i32;` then
  `buf.ptr` to extract `*u8` for callees that still take raw pointer
  (cstrinto/byteinto/readall/getdents64/...).
- γ: `let arr: []*u8 = alloc([], N)!; arr.len = N;` element-count
  semantics (was bytes; ww slice alloc takes element count).

i32 .len cast: ww's slice.len is i32 so `.len = N` from a u64
source requires an explicit `: i32` cast or silent-zero results.

The previously-flagged `out = rt.malloc(PATH_MAX): *u8` reassignment
in dobuild migrates cleanly: locally allocate `outbuf: []u8`, then
`out = outbuf.ptr` to preserve the `*u8` shape for the else-branch
from defaultoutpath. No GC + process-exit reclaim makes the bare
.ptr lifetime-safe (no free path needed).

0 sites deferred. Verified make test 132/132 + 995_self_rebuild
byte-identity. Advances #44.

selfhost/cmd/wwdump/main.ww

@@ -100,8 +100,9 @@ export fn main(argc: i32, argv: **u8) i32 = {
 	};
 
 	let a: *arena = newarena();
-	let buf: *u8 = amalloc(a, sz: u64): *u8;
-	let rr: (i64 | os.oserror) = os.readall(fd, buf, sz: u64);
+	let buf: []u8 = alloc([], sz: u64)!;
+	buf.len = sz: i32;
+	let rr: (i64 | os.oserror) = os.readall(fd, buf.ptr, sz: u64);
 	os.close(fd);
 	let r: i64 = 0i64;
 	match (rr) {
@@ -117,7 +118,7 @@ export fn main(argc: i32, argv: **u8) i32 = {
 	};
 
 	let l: lex;
-	lexinit(&l, a, argstr(path), buf, sz: u64);
+	lexinit(&l, a, argstr(path), buf.ptr, sz: u64);
 
 	if (mode == 116) {	// '-t'
 		for (true) {