Phase 8b: modern names for the raw-memory and OS/IO primitives

Groups B and C of the leftover-primitive cleanup — renames, not new machinery,
and deliberately NO unsafe_ prefix (a __-prefix is itself a C convention, and an
`unsafe` marker carries no signal in a fully-manual-memory language with no safe
subset to contrast against).

  memory:  mem_free -> free   mem_realloc -> resize   mem_set -> fill
           ptr_add -> offset
  process: os_argc -> arg_count   os_arg -> arg   os_exit -> exit
           os_system -> run   os_getenv -> getenv   read_byte -> read_char
  dead:    mem_copy, os_time, write_byte (0 uses) — deleted

Two reseeds: accept both old and new names in the intrinsic dispatch, then
migrate every call site and drop the old names. file_open/read/write/seek/tell/
close are left as-is — they're the domain-prefixed syscall layer wrapped by
read_file, not the argc/argv-style C-ness the audit targeted; a `File` type is a
separate, larger design if wanted.

test.sh's CLI smoke updated (os_exit -> exit); check-vocabulary's grammar marker
moved off the deleted names. Reseeded (22243 lines); C-free fixpoint holds;
goldens identical; 18/18; vocab + doc-fences clean.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

selfhost/main.ludic

@@ -33,7 +33,7 @@ fn strip_ludic(name: ptr) -> ptr {
 
 # env var with a fallback when unset
 fn getenv_or(name: ptr, dflt: ptr) -> ptr {
-  let v = os_getenv(name)
+  let v = getenv(name)
   if (v == null) { return dflt }
   return v
 }
@@ -48,7 +48,7 @@ fn ensure_slash(d: ptr) -> ptr {
 
 fn die(msg: ptr) -> void {
   file_write(file_stderr(), msg, len(msg))
-  os_exit(1)
+  exit(1)
 }
 
 entry {
@@ -61,18 +61,18 @@ entry {
   var run = false         # compile then execute the result
 
   # multi-call: invoked as `ludic` -> run mode by default
-  if (base_name(os_arg(0)) == "ludic") { run = true }
+  if (base_name(arg(0)) == "ludic") { run = true }
 
   var ai = 1
-  while ai < os_argc() {
-    let a = os_arg(ai)
+  while ai < arg_count() {
+    let a = arg(ai)
     if (a == ("--windowed")) { want = 1 }
     else { if (a == ("--headless")) { want = 2 }
     else { if (a == ("--emit-llvm")) { emit_ir = true }
     else { if (a == ("--fmt")) { fmt = true }
     else { if (a == ("--save-temps")) { save = true }
     else { if (a == ("--run")) { run = true }
-    else { if (a == ("-o")) { ai = ai + 1;  if ai < os_argc() { out = os_arg(ai) } }
+    else { if (a == ("-o")) { ai = ai + 1;  if ai < arg_count() { out = arg(ai) } }
     else {
       # an unknown flag is ignored (with a note) rather than mistaken for the
       # input file — '-' is ASCII 45
@@ -97,7 +97,7 @@ entry {
   # --fmt is the doc-check gate: reaching here means it lexed and parsed. A parse
   # error would already have exited nonzero, so a clean parse exits 0. (Canonical
   # formatting output is not yet reimplemented on the self-hosted toolchain.)
-  if fmt { os_exit(0) }
+  if fmt { exit(0) }
 
   maybe_splice_runtime()
 
@@ -122,13 +122,13 @@ entry {
 
   # make the output directory if the user asked for e.g. bin/app
   let odir = dir_of(out)
-  if len(odir) > 0 { os_system(`mkdir -p {odir}`) }
+  if len(odir) > 0 { run(`mkdir -p {odir}`) }
 
   let ll = `{out}.ll`
   if not ir_flush(ll) { die("ludicc: cannot write IR\n") }
 
   let cc   = getenv_or("LUDIC_CC", "clang")
-  let home = ensure_slash(getenv_or("LUDIC_HOME", dir_of(os_arg(0))))
+  let home = ensure_slash(getenv_or("LUDIC_HOME", dir_of(arg(0))))
 
   # clang twice: assemble the IR, then link. A windowed build adds the macOS
   # platform layer and the Cocoa framework.
@@ -141,13 +141,13 @@ entry {
   }
   cmd = `{cmd} -o {out}`
 
-  let rc = os_system(cmd)
-  if not save { os_system(`rm -f {ll}`) }
+  let rc = run(cmd)
+  if not save { run(`rm -f {ll}`) }
   if rc != 0 { die("ludicc: link failed\n") }
 
   # run mode: execute the binary we just built and forward its exit code
   if run {
-    let st = os_system(out)
-    os_exit(((st >> 8) & 255))
+    let st = run(out)
+    exit(((st >> 8) & 255))
   }
 }