exec: Linux's 2 MB of arguments; mmap: merge neighbouring mappings

exec took 32 arguments and 64 environment variables, in fixed arrays,
so a glob over more than 31 files failed with E2BIG. It now reads the
caller's argv and envp where they are, through the uaccess helpers and
a bounce page -- a second thread rewriting the array after a check
cannot slip a kernel address in -- and sizes the new stack to fit
them. The limits are Linux's: ARG_MAX, 2 MB of strings and pointers,
and 128 KB for any one string (USER_STR_MAX follows it).

Every mmap took one of a process's 256 VMA slots, and zsh takes one per
16 KB heap block, so `x=($(<file))` over 30000 words ran out after 4 MB
of heap and exited 1 without a word. Neighbouring anonymous mappings
now share a record, as Linux merges them -- the bump allocator puts
each new one where the last ended -- and munmap trims or splits it.
Partial unmaps of device or segment mappings are refused with EINVAL
instead of kfree()ing pages that are not the process's, and a failed
allocation half way through a mapping no longer leaks what it had.

Checked under QEMU: touch over 3000 names, /bin/echo with 50000
arguments, E2BIG past 2 MB, zsh splitting 100000 words, fork loops.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01S1giNvrHTrPMPw7V6x1kQ4

include/file.h

@@ -194,6 +194,9 @@ int ibusy(uint dev, uint64 except);
 // Path lookup that follows a final symlink too; 0 with *err set on failure.
 // `start` 0 means the cwd. In fs.c.
 struct inode *nameifollow(struct inode *start, char *path, int *err);
+// execve(2) with the argv and envp arrays still in the caller's memory. In
+// exec.c; exec() is the same for arrays the kernel holds.
+int exec_user(char *path, addr_t uargv, addr_t uenvp);
 
 // table mapping major device number to
 // device functions