fix: 3 residual bugs from round-3 audit

fix: 3 residual bugs from round-3 audit

5. dlopen page leak: if pmm_alloc_page() fails mid-segment-load,
   rollback all previously mapped pages (unmap + pmm_free_page)
   instead of leaking them. Added vmm_virt_to_phys() API to
   recover physical frames before unmapping.

6. CLONE_THREAD without CLONE_VM: Linux requires CLONE_THREAD to
   imply CLONE_VM (threads share address space). Now returns
   -EINVAL if CLONE_THREAD is set without CLONE_VM, preventing
   unexpected behavior where a "thread" gets its own AS copy.

7. pipe_close SMP race: readers/writers decrement and conditional
   kfree(ps) were unprotected by a lock. Added spinlock_t to
   pipe_state and wrapped the critical section in
   spin_lock_irqsave, preventing underflow/double-free when both
   pipe ends are closed concurrently on different CPUs.