security: critical kernel memory isolation and W^X fixes (Round 1)

security: critical kernel memory isolation and W^X fixes (Round 1)

K01: mmap MAP_FIXED end address validation - prevent user from mapping
     across kernel boundary or overflow
K02: mprotect range kernel boundary check - reject ranges crossing into
     kernel space before permissive stack fallback
K03: shm_at address validation - check alignment and kernel boundary for
     user-supplied shmaddr, use vmm_find_free_area for auto-assigned
A01: NX flag preservation in COW - vmm_as_clone_user_cow and
     vmm_handle_cow_fault now preserve X86_PTE_NX to maintain W^X
     protection across fork and page fault resolution

Tests: 116/116 QEMU, 142/142 battery, 111/111 host, cppcheck clean