feat: relibc S1 — sem_open refcounting + glibc cross-reference assessment

Phase S1 (Critical Correctness):
- sem_open/sem_close: global refcounting via BTreeMap + AtomicUsize
- sem_close: decrements refcount, munmaps only at zero
- sem_open: reuses existing mapping, O_EXCL returns EEXIST
- sem_unlink: marks entry for removal before shm_unlink
- va_list parsing: reads mode_t and value from stack after oflag
- All 11 sem_* functions verified in libc.so T

Phase S2-S4 (Designed, documented):
- eventfd() function, signalfd read path, EINTR handling
- name canonicalization, cancellation safety
- Full plan in local/docs/RELIBC-AGAINST-GLIBC-ASSESSMENT.md

Reference: glibc 2.41 cloned to local/reference/glibc/

Boot verified: greeter ready on VT 3 with refcounted semaphores

recipes/core/relibc/recipe.toml

@@ -36,7 +36,7 @@ patches = [
     "P3-inet6-pton-ntop.patch",
     "P3-tcp-nodelay.patch",
     "P3-tcp-sockopt-forward.patch",
-    # Named POSIX semaphores (sem_open/close/unlink) — comprehensive implementation
+    # Named POSIX semaphores (sem_open/close/unlink) — comprehensive + refcount + va_list
     "P3-semaphore-comprehensive.patch",
     # Reverse From<&syscall::TimeSpec> for timespec (needed by getrusage)
     "P3-timespec-reverse-from.patch",