security: complete AIO validation (H1)

security: complete AIO validation (H1)

- Add fd mode validation in syscall_aio_rw_impl:
  - Reject aio_read on O_WRONLY fd (except char devices)
  - Reject aio_write on O_RDONLY fd (except char devices)
  - Reject aio_write on MS_RDONLY mount
- Reuse same policy as read/write/pread/pwrite syscalls
- Fix fulltest AIO test to use O_RDWR instead of O_WRONLY
  (test was incorrectly trying to read from write-only fd)

Validation:
- make -j12: PASS
- make test-host: PASS (111/111)
- make test SMOKE_SMP=4: PASS (127/127)
- make test-battery: PASS (153/153)
- make analyzer: PASS

Addresses H1 from docs/URGENT_SECURITY_STATUS_2026-06-09.md