v0.7.0: COW fork

paging_copy_user_pgdir no longer eagerly duplicates every user frame.
At fork time, parent and child share frames; writable pages are tagged
PG_COW (PTE software bit 9) and have their RW bit cleared on BOTH
sides. The first writer takes a #PF which a new paging_handle_cow_fault
resolves by either restoring RW (last owner) or allocating + copying
into a fresh frame (the writer's PTE then points at the private copy
while the original sticks with the other owner).

Read-only pages (.text / .rodata under v0.5 W^X) stay shared without
PG_COW -- writes to those remain real W^X violations and the trap path
kills the offender as before.

Cuts fork cost from "memcpy every present user frame" to "flip RW +
ref_inc". Typical apps that fork then exec touch only a handful of
pages before the exec replaces everything, so most copies that the
eager path performs never have to happen at all.

PMM gains a per-frame u8 refcount (pmm_ref_inc, pmm_free now ref-aware,
pmm_ref for diagnostics). Single-CPU only -- when SMP lands, refcount

• COW need atomic ops + per-CPU lock.

4 atomic commits: PMM refcount, COW infra, smoke-cow test, CHANGELOG.