security: Round 1-2 fixes (A02, A03, A04, A14, A16, partial A07)

security: Round 1-2 fixes (A02, A03, A04, A14, A16, partial A07)

- A16: pmm_decref underflow guard in src/mm/pmm.c
- A02: sysenter.S stack pointer validation with 8-byte kernel margin
- A03: pread/pwrite mode validation (rejects O_WRONLY for pread, O_RDONLY for pwrite, checks MS_RDONLY)
- A04: Reject O_RDONLY|O_TRUNC in open syscall
- A14: truncate/ftruncate storage update via vfs_truncate_node helper with fallback
- A07: vfs_check_parent_permission helper added to fs.c, applied to unlink/rmdir/rename/mkdir/link/create (allows all for now - single-user root system)

Note: A01 (W^X/NX default) removed temporarily due to kernel panic - needs NX bit investigation
Note: K02 (mprotect per VMA) deferred - requires per-page VMA architecture

Tests: 119/119 PASS (smoke test, SMP=4)