build: fix four things a clean build found, three of them mine

`make` had been failing since the e1000 work and I did not see it, because I
was checking build output with `grep error` -- which matches neither "Błąd" nor
mkfs's "image full". Checking the exit status instead found all of this in a
minute.

**usbstick.img was full.** `make ldls-stage` puts a module and its BTF in
sysroot/lib/modules, and a vmlinux BTF is 5 MB on its own; the 16 MB test image
could not hold it. The size cannot move -- tools/windows/bootcheck.ps1 asserts
READ CAPACITY returns exactly 32768 sectors -- so the exclusions grew instead:
lib and usr as well as bin. That image exists to prove the USB driver can read
one block, so its contents were never the point. It also stopped a GPL module
riding into a test artifact, which RAMDISK_EXCLUDE does for the ramdisk and
nothing was doing for this one.

**toybox's httpd was shadowing ours.** /bin/httpd answered `-p` with toybox's
"Unknown option 'p'", because whichever install rule ran second won the name.
TOYBOX_SKIP existed for exactly this and held one entry, `ping`, found the same
hard way. It is now generated from cmd/ -- a list you have to remember is a
list that is wrong the next time cmd/ grows, and it already was: `chvt` had
been silently toybox's, whose VT ioctls are Linux's and not ours.

**ldlsd would not link with clang.** `*out = in;` on a 96-byte struct is a call
to memcpy as far as the C standard is concerned; gcc unrolled it and clang
emitted the call, so a freestanding program linked for months and then did not
on a machine where nothing about it had changed but the compiler. lib/glue.c
now provides memcpy, memmove, memset and memcmp -- the four an implementation
may call without being asked.

**OVMF was never found on NixOS.** `$(dir $(QEMU))share` is the *bin*
directory plus "share", so it looked in /usr/bin/share. The absolute paths
after it covered that up on distributions that keep firmware in /usr; on one
that keeps nothing there it meant the firmware was undiscoverable on a machine
that had it, and the only way to build was to copy the file in by hand. It
resolves the prefix properly now and looks in <prefix>/share/qemu too.

Verified by exit status, from a clean tree and a no-op: both 0. ldls-check
passes 27. The guest boots, serves /srv to the host and answers 403 to
%2e%2e/etc/passwd.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VQ7Qx8E1q1M1bbCq8QLHS2

ports/toybox/Makefile

@@ -18,9 +18,20 @@ include ../mk/port.mk
 # applet replaced the shared inode and every applet became ping; installing
 # the applet over first-party ping put it back and lost the real one.
 #
-# SchOS's ping talks to its own lwIP stack and knows there is no resolver yet.
-# toybox's would be the wrong answer even if it worked.
-TOYBOX_SKIP = ping
+# SchOS's ping talks to its own lwIP stack. toybox's would be the wrong answer
+# even if it worked.
+#
+# The list is generated rather than remembered, because remembering it failed:
+# `ping` was found the hard way, and then `httpd` was found the same hard way
+# months later -- /bin/httpd ran, printed toybox's "Unknown option 'p'" and
+# nobody could see why the web server had no -p flag. Anything in cmd/ that
+# toybox also provides belongs here, and asking the directory is the only
+# version of that which stays true when cmd/ grows.
+#
+# `chvt` is in the list for the same reason and was never noticed: toybox's
+# wants Linux's VT ioctls, ours talks to SchOS's own terminal layer, and which
+# one you got depended on the order two install rules happened to run in.
+TOYBOX_SKIP = $(notdir $(wildcard $(TOPDIR)/cmd/*))
 
 TOYBOX_VERSION := 0.8.12
 TOYBOX_URL     := http://landley.net/toybox/downloads/toybox-$(TOYBOX_VERSION).tar.gz
@@ -130,7 +141,10 @@ $(BUILDDIR)/toybox.installed: $(BUILDDIR)/toybox | $(SYSROOT)/bin
 	    ln $(SYSROOT)/bin/toybox $(SYSROOT)/bin/"$$a" 2>/dev/null \
 	      || cp $< $(SYSROOT)/bin/"$$a"; \
 	done
-	@echo "toybox: installed $$($(BUILDDIR)/toybox | wc -w) applets"
+	@echo "toybox: installed $$($(BUILDDIR)/toybox | wc -w) applets, minus" \
+	      "$$(for a in $$($(BUILDDIR)/toybox); do \
+	            case " $(TOYBOX_SKIP) " in *" $$a "*) echo $$a ;; esac; \
+	          done | tr '\n' ' ')(first-party)"
 	@touch $@