refactor: build system improvements — ulibc out-of-tree, -Werror, noexecstack, doom...

refactor: build system improvements — ulibc out-of-tree, -Werror, noexecstack, doom target

1. ulibc out-of-tree build: .o files now go to build/$ARCH/user/ulibc/
   instead of in-tree user/ulibc/src/. BUILDDIR passed from root Makefile.

2. ulibc -Werror: added -Werror, removed -Wno-incompatible-pointer-types.
   Fixed warnings:
   - execve signature in unistd.h: const char* const* -> char* const* (POSIX)
   - execve impl in unistd.c, execle: match new signature
   - pthread.c: removed unused thread_entry_trampoline
   - socket.c: suppress unused addrlen in sendto/recvfrom
   - sh.c, env.c, init.c: remove stale const casts for execve

3. .note.GNU-stack: added -z noexecstack to linker flags in common.mk
   and doom Makefile. GNU_STACK segment now RW (not RWE).

4. make doom: new phony target in root Makefile builds doom via sub-Make,
   passing ULIBC_BUILDDIR. Doom LDFLAGS now use out-of-tree ulibc path.

5. which test: added positive test (which finds sh) alongside the existing
   negative test (which rejects missing cmd).

Tests: 103/103 smoke, 69/69 host utils, cppcheck clean