feat(fs): support O_CLOEXEC, fd table limit, and fix pipe2/dup3/dup

• O_CLOEXEC (close-on-exec):

  • Add FdEntry wrapper around Arc with per-fd cloexec field, keeping FD_CLOEXEC independent from the shared open file description
  • FdTable::close_on_exec() closes all cloexec-marked fds during exec()
  • sys_openat/sys_pipe2: parse O_CLOEXEC from user flags, set on new fd; strip O_CLOEXEC before passing to VfsFile.flags
  • sys_dup3: set/clear cloexec based on flags argument
  • sys_dup: always clear cloexec on new fd (POSIX)

• O_NONBLOCK for pipe2:

  • make_pipe() now accepts OpenFlags, passes O_NONBLOCK to VfsFile via new_dev_with_flags(); read end uses O_RDONLY, write end O_WRONLY
  • Existing WouldBlock -> EAGAIN logic in sys_read/sys_write applies

• FdTable limit (RLIMIT_NOFILE):

  • Add limit field (default 256), try_alloc_fd/try_insert return Option
  • All syscall-layer callers return EMFILE when fd table exhausted
  • sys_dup3 checks newfd < limit, returns EBADF on violation
  • Manual Default impl ensures limit is set correctly

• Rename SysErrNo -> SyscallErrNo for clarity