exec: Linux's 2 MB of arguments; mmap: merge neighbouring mappings

exec took 32 arguments and 64 environment variables, in fixed arrays,
so a glob over more than 31 files failed with E2BIG. It now reads the
caller's argv and envp where they are, through the uaccess helpers and
a bounce page -- a second thread rewriting the array after a check
cannot slip a kernel address in -- and sizes the new stack to fit
them. The limits are Linux's: ARG_MAX, 2 MB of strings and pointers,
and 128 KB for any one string (USER_STR_MAX follows it).

Every mmap took one of a process's 256 VMA slots, and zsh takes one per
16 KB heap block, so `x=($(<file))` over 30000 words ran out after 4 MB
of heap and exited 1 without a word. Neighbouring anonymous mappings
now share a record, as Linux merges them -- the bump allocator puts
each new one where the last ended -- and munmap trims or splits it.
Partial unmaps of device or segment mappings are refused with EINVAL
instead of kfree()ing pages that are not the process's, and a failed
allocation half way through a mapping no longer leaks what it had.

Checked under QEMU: touch over 3000 names, /bin/echo with 50000
arguments, E2BIG past 2 MB, zsh splitting 100000 words, fork loops.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01S1giNvrHTrPMPw7V6x1kQ4

include/uaccess.h

@@ -39,7 +39,7 @@ int copy_to_user(addr_t uaddr, const void *src, uint64 n);
 #define put_user(x, uaddr)  copy_to_user((addr_t)(uaddr), &(x), sizeof(x))
 
 // Longest string fetchstr()/strlen_user() will scan before giving up.
-#define USER_STR_MAX 32768
+#define USER_STR_MAX (128 * 1024)   // = ARG_STRLEN_MAX: an argument is one
 
 // Length of the NUL-terminated string at uaddr (excluding the NUL),
 // validating every page it spans. -EFAULT if it runs off mapped memory