Heap space optimization: RP2350 heap 212 KB -> 356 KB

Heap space optimization for RP2350.

On RP2350 .bss and the heap are the same budget — the page allocator starts where the image
ends — so a static buffer serving an idle subsystem is heap no other subsystem can have. The
chess persona had reached 100% of the heap at peak, which meant nothing further could be added
to the system at all.

Managed heap 212 KB → 356 KB (53 → 89 pages); static RAM 283 KB → 144 KB; chess peak 53/53 → 28/89.

Rare-but-large working memory (the compiler's pools, the chess engine's move-list pools and
position scratch, Lisp's file buffers, the U-mode probe stacks) is now taken from the heap on
demand and given straight back; the Lisp string pool is tiered by measured string length; the 9P
message size and chess search limits are board-scaled; and constant tables that were computed
into RAM at boot live in flash. Every change was measured on real silicon rather than estimated —
including confirming that reading the Zobrist tables from XIP flash costs nothing (188.6K vs
185.5K nps on perft).

Guarded going forward by a link-time heap floor (the build fails if the heap drops below
256 KB), a sizecheck target that fails on any static-RAM growth against a per-file baseline, and
/proc/meminfo / /proc/ps reporting the static breakdown and per-task stack high-water marks.

This release also carries the previously unreleased 0.10.0 work: Lisp tail-call optimization, a
mark-sweep garbage collector, a C-primitive standard library, and the host/p9lib + host/fuse-p9
9P host tooling (mount a running board as a filesystem). Six unrelated bugs were found and fixed
along the way, including a stale-board-config build hazard, a console input path that discarded
type-ahead during long commands, and a 9P iounit that promised more than the connection could
carry.

The chess board UI and the terminal are now one session with two live input devices: console
commands work while a game is being played on the keypad.

Verified: 249/249 QEMU tests (RV32 NOMMU + RV64 Sv39), 24/24 hardware-in-the-loop tests against
real RP2350 silicon running these exact images.