feat: real advisory file locking (flock) replacing no-op stub

feat: real advisory file locking (flock) replacing no-op stub

- syscall.c: implemented flock_table (64 entries) with spinlock-protected
  advisory locking supporting LOCK_SH, LOCK_EX, LOCK_UN, LOCK_NB
- flock_do(): handles shared/exclusive acquisition with conflict detection,
  upgrade/downgrade of existing locks, blocking retry via process_sleep
- flock_release_pid(): releases all locks for a process on exit
- SYSCALL_EXIT: calls flock_release_pid before closing files
- errno.h: added ENOLCK=37, EWOULDBLOCK=EAGAIN (kernel + userland)
- sys/file.h: new userland header with LOCK_SH/EX/NB/UN defines

Previously flock() was a silent no-op returning 0. Now it provides
real advisory locking semantics needed by SQLite and daemons.

20/20 smoke tests pass.