Adjust thread exec de-threading to reduce false fatal exits under load - #309

The warning set in mk/config.mk is strong and every diagnostic only
printed. The gates around it, syscall coverage and the EINTR contract
and the proof targets, all fail the build instead, so a compiler
warning was the one signal a reader had to notice unaided. WERROR=0
turns it off, which is what a newer compiler with a new warning wants:
the flag must not be the reason a fresh clone stops building.

tests/test-casefold-walk-host.c indexed a string literal by a size_t
walk offset twice, which -Wstring-plus-int reads as an attempt to
concatenate. The arithmetic is right and the spelling is not, so the
literal takes a name and the offsets index an array.

This process parses input the guest fully controls: its ELF, every
syscall argument, FUSE frames, netlink messages, sockaddr and cmsg
blobs. The bounds math for those is proved in src/proved/, and the
proofs cover the arithmetic rather than the call sites consuming it.
PIE is already the Darwin default; -fstack-protector-strong and
_FORTIFY_SOURCE are not.

_FORTIFY_SOURCE is skipped under AddressSanitizer alone, which
predefines it to 0 on purpose since its interceptors do the same job,
so redefining it is a -Wmacro-redefined error under the -Werror above.
UBSAN and TSAN predefine nothing and keep it, which is what makes those
lanes exercise the same libc entry points the shipped binary calls.

Each -fsanitize= argument is split on commas and matched by name. A
substring test for -fsanitize=address is order-dependent while reading
as if it were not: it answers correctly for -fsanitize=address,undefined
and wrongly for -fsanitize=undefined,address, the same request spelled
the other way round.

The block at the top of src/syscall/internal.h documented an 11-entry
acquisition order and presented it as the ordering. Two of those entries
name a per-instance lock by role, so it covered 9 of the tree's 31
file-scope locks, and seven of the twenty-two it left out are held
across another acquisition: autoreap_lock over pid_lock and pidfd_lock,
elf_path_lock over cwd_lock and sysroot_lock, oom_write_lock over
fd_lock, fuse_lock over the per-session lock, proc_tmpdir_lock over
mmap_lock, pty_keepalive_lock over fd_lock, and cwd_lock over fuse_lock.
Each is correct as written, and a reader adding the next lock had no
rule to consult.

The FUSE per-session lock reaches fd_lock and sig_lock through
asyncio_fire, so the pairing with fuse_lock is not the whole of its
ordering. log_mutex sits below the entire order rather than beside the
other leaves, since any lock may log while held. sig_lock is not a leaf:
signal_queue_thread_common takes thread_lock under it.

A leaf list closes the set, so the two lists together are exhaustive: a
new lock belongs in one of them, and a leaf that grows a call to another
locker moves up. The numbered "Lock order: N" comments at the
definitions are not indices into this list; a number there records only
which locks that one was known to precede when it was written.