feat(fs): binary-safe length-bearing file I/O through the native ABI and libc (refs #765)

[rwrife]

Summary

DEMO-01 (#765) slice: binary-safe, length-bearing file I/O through the native ABI and libc, reusing the existing kernel fs operations and capability/consent gates.

• Public ABI + runtime (secureos_api.h, secureos_api_stubs.c): new os_fs_read_file_bytes / os_fs_write_file_bytes wrappers. Additive native-bridge slots; bridge version 4 -> 5; no OS_ABI_VERSION bump. Argument guards run before any bridge dereference; *out_len is pinned to 0 on every failure path; empty-file read is a clean OK-with-zero-length EOF.
• Kernel bridge (launcher_exec.c): app_native_fs_read_file_bytes / app_native_fs_write_file_bytes call the existing fs_read_file_bytes / fs_write_file_bytes ops behind the exact same CAP_FS_READ/CAP_FS_WRITE + CAP_DISK_IO_REQUEST + per-operation disk-IO consent gates as the text pair — denied access performs no write and reports denial. Wire errors map NOT_FOUND vs capacity/storage distinctly.
• clib fd adapter (posix_fd.c): snapshots now read and flush with actual byte lengths; the strnlen length inference and the documented embedded-NUL flush truncation are gone. Existing text callers keep their behavior (the text pair itself is unchanged).
• Gates: clib_posix_fd extended with byte-exact leading/interior/trailing NUL read + create/append round-trips; new native_fs_bytes_wrapper host gate drives the wrappers over a synthetic v5 bridge page (exact-byte transport, pre-v5 handshake degrade, full return-code mapping, argument guards). Wired into test.sh, its usage list, and validate_bundle.sh TEST_TARGETS.
• Bridge-version follow-through: process_exit_qemu / process_spawn_argv_roundtrip synthetic bridge pages bumped to v5 (required by the runtime handshake — same bookkeeping as every prior bridge bump).
• Docs: docs/abi/syscalls.md filesystem table gains both calls with the explicit short-read/EOF/capacity/deny contract; docs/abi/clib-symbols.md fd-surface notes and the vendor/tinycc/libc-deps.json open-symbol note retire the text-payload limitation. Two-commit stamp pattern: stamp-only commit repoints both docs' Last verified lines to the content commit.

Test evidence (host gates, local green)

clib_posix_fd, native_fs_bytes_wrapper, abi_version, clib_stdio, clib_symbol_drift, fs_service, launcher_fs, app_runtime, mem_brk_wrapper, clib_os_brk, mem_brk_qemu, mem_brk_arena_cap_deny, process_exit_wrapper, process_exit_qemu, process_spawn_wrapper, process_spawn_argv_roundtrip, sosh_cap_cat_ls, sosh_cap_write_append, validate_sosh_capability_contract, tinycc_libc_deps, validate_abi_stamps.

Scope notes

• Does not close DEMO-01: Expose binary-safe filesystem I/O through the native ABI and libc #765: the issue's remaining acceptance bullets are booted-guest evidence (binary write/reopen/compare on the real FAT path, real archive read, ELF/SOF persistence at demo sizes, guest-path denial behavior). A follow-up guest-evidence slice will carry Closes #765.
• Deliberately untouched per the issue: real unlink and stdin improvements (not prerequisites for the compiler path).

Refs #765