Cheaper cursor, a fortify panic that names its function; Finch's gap

The cursor now costs nothing for a byte inside an escape sequence and
one cell fewer for a plain glyph: the grid is the truth, so the old
cursor cell is repainted after the byte, and not at all when a glyph
has just been drawn over it.

__fortify_panic says "r8169: rtl_open.cold+0x..." through ldlsd's module
list, so a photograph of the screen is enough, and exits instead of
spinning on a core and holding /dev/netdev.

docs/plan/finch.md: only integrating Finch is later; finishing it is
not. The self-hosting gap measured against Finch's own bootstrap test.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015f73FesGZGYPkmDvUcj6QX

ldls/kpi/kpi.h

@@ -152,6 +152,9 @@ unsigned long kpi_jiffies_now(void);
 // Output. The KPI is inside a process with no libc, and every implementation
 // wants to be able to say what it did.
 void kpi_log(const char *s);
+// Says "module+0xoffset" for an address in a loaded module; set by the host.
+extern void (*kpi_where)(unsigned long addr);
+
 void kpi_lognum(long long v);
 void kpi_loghex(unsigned long long v, int digits);