Fix mmap accounting under partial munmap churn

[brandonpayton]

Summary

• Round munmap lengths up to the Wasm page size before kernel bookkeeping and host mmap cleanup checks.
• Coalesce adjacent compatible mmap regions and avoid allocating a temporary occupied-region vector during gap search.
• Restore fork-deserialized mappings in sorted/coalesced order so the gap-search invariant is preserved.

Root cause

SQLite memsubsys1/altermalloc.test repeatedly mapped roughly 0x30000-byte regions and unmapped caller lengths around 0x29000. Kandelo rounded mmap to 64 KiB pages but used the literal munmap length in memory bookkeeping, leaving tiny tail mappings. Under mmap churn, those tails inflated the mapping list and the allocator path eventually hit RuntimeError: unreachable in focused Node/browser SQLite lanes.

Validation

• cargo test -p kandelo --target aarch64-apple-darwin --lib: 964 pass / 0 fail / 0 skip. Artifact: /Users/brandon/src/kandelo-gascity/worktrees/kandelo/kd-cfo.4-debug-wave34-browser-memsubsys-readonly-sqlite-failures/test-runs/kd-cfo.4/kernel-full-lib-after-current-rebuild-20260623T213359Z
• cd host && npx vitest run: 752 pass / 0 fail / 108 skip, exit 0. Exact gate artifact: /Users/brandon/src/kandelo-gascity/worktrees/kandelo/kd-cfo.4-debug-wave34-browser-memsubsys-readonly-sqlite-failures/test-runs/kd-cfo.4/host-vitest-after-hello64-20260623T213936Z; JSON outcome lists: /Users/brandon/src/kandelo-gascity/worktrees/kandelo/kd-cfo.4-debug-wave34-browser-memsubsys-readonly-sqlite-failures/test-runs/kd-cfo.4/host-vitest-json-outcomes-20260623T214029Z
• scripts/run-libc-tests.sh: 303 pass / 0 fail / 0 skip, plus 1 flake-pass and 20 documented XFAIL, exit 0. Artifact: /Users/brandon/src/kandelo-gascity/worktrees/kandelo/kd-cfo.4-debug-wave34-browser-memsubsys-readonly-sqlite-failures/test-runs/kd-cfo.4/libc-tests-after-submodule-init-20260623T214334Z
• scripts/run-posix-tests.sh: 174 pass / 0 fail / 2 skip, plus 3 documented XFAIL, exit 0. Artifact: /Users/brandon/src/kandelo-gascity/worktrees/kandelo/kd-cfo.4-debug-wave34-browser-memsubsys-readonly-sqlite-failures/test-runs/kd-cfo.4/posix-tests-after-munmap-fix-20260623T215119Z
• bash scripts/check-abi-version.sh: passed with dev-shell nightly plus explicit bzip2/xz library paths. Artifact: /Users/brandon/src/kandelo-gascity/worktrees/kandelo/kd-cfo.4-debug-wave34-browser-memsubsys-readonly-sqlite-failures/test-runs/kd-cfo.4/abi-check-dev-shell-nightly-bzip2-path-after-munmap-fix-20260623T213546Z
• Focused SQLite browser memsubsys cluster after rebuild: 4 pass / 0 fail / 0 skip / 0 incomplete. Artifact: /Users/brandon/src/kandelo-gascity/worktrees/kandelo/kd-cfo.4-debug-wave34-browser-memsubsys-readonly-sqlite-failures/test-runs/kd-cfo.4/focused-browser-memsubsys1-cluster4-after-current-rebuild-20260623T213021Z
• Focused SQLite browser readonly representative cluster after rebuild: 8 pass / 0 fail / 0 skip / 0 incomplete. Artifact: /Users/brandon/src/kandelo-gascity/worktrees/kandelo/kd-cfo.4-debug-wave34-browser-memsubsys-readonly-sqlite-failures/test-runs/kd-cfo.4/focused-browser-readonly-unableopen8-after-current-rebuild-20260623T213224Z

Notes

• cargo fmt -p kandelo --check was attempted and is blocked by pre-existing formatting drift in unrelated parts of syscalls.rs and wasm_api.rs; no broad rustfmt was applied to avoid unrelated churn.
• The focused long Node SQLite DB row passes after this fix but the wrapper process exits 132 with RuntimeError: unreachable after the done row; follow-up bead kd-cfo.5 tracks that separate post-pass runtime issue.
• No ABI snapshot/version change is needed; the ABI check reports generated bindings and snapshot up to date.

[github-actions]

Phase B-1 matrix build status — pr-769-staging

ABI v15. 67 built, 0 failed, 67 total.

Package	Arch	Status	Sha
libcurl	wasm32	built	1dd45a75
libcxx	wasm32	built	456cb624
libcxx	wasm64	built	615becef
libpng	wasm32	built	ebe7bdb4
libxml2	wasm32	built	2da98d6d
libxml2	wasm64	built	acde9763
openssl	wasm32	built	53468669
openssl	wasm64	built	0089b5e9
sqlite	wasm32	built	dbd0f8ad
sqlite	wasm64	built	9b8bf74c
zlib	wasm32	built	e77113ed
zlib	wasm64	built	55ce9cbd
bc	wasm32	built	f23cd5e9
bzip2	wasm32	built	59a5055b
coreutils	wasm32	built	a5dc43e2
curl	wasm32	built	097b4204
dash	wasm32	built	69e89a1b
diffutils	wasm32	built	0c68da0c
dinit	wasm32	built	f7bf7ba2
fbdoom	wasm32	built	14d77d19
file	wasm32	built	7d2ae69e
findutils	wasm32	built	2c0bbc1e
gawk	wasm32	built	952fe64e
git	wasm32	built	8624583d
grep	wasm32	built	f92e27f6
gzip	wasm32	built	4e6f687a
kandelo-sdk	wasm32	built	31c309e0
kernel	wasm32	built	93b5fa30
less	wasm32	built	2864ec15
lsof	wasm32	built	5e214f7a
m4	wasm32	built	314ab10f
make	wasm32	built	65d911c5
mariadb	wasm32	built	3a82fd8d
mariadb	wasm64	built	6ad68821
modeset	wasm32	built	24eb4314
msmtpd	wasm32	built	5fedaf14
nano	wasm32	built	2e132e4c
ncurses	wasm32	built	bf54a8a5
netcat	wasm32	built	6418bf28
nginx	wasm32	built	b7a7edcf
php	wasm32	built	c9c76f5a
posix-utils-lite	wasm32	built	7a8832f7
sed	wasm32	built	20822b10
spidermonkey	wasm32	built	d26e2f51
tar	wasm32	built	9f914c7c
tcl	wasm32	built	72be24b3
unzip	wasm32	built	34c92ea0
userspace	wasm32	built	b9db89b9
vim	wasm32	built	c5cfabfb
wget	wasm32	built	4dd34f44
xz	wasm32	built	59669070
zip	wasm32	built	8e1f7882
zstd	wasm32	built	c19e7903
bash	wasm32	built	413c2b36
mariadb-test	wasm32	built	28685d6a
mariadb-vfs	wasm32	built	6b0a763f
mariadb-vfs	wasm64	built	abb53016
nethack	wasm32	built	2d70102d
node	wasm32	built	31b3708f
spidermonkey-node	wasm32	built	200f58d7
vim-browser-bundle	wasm32	built	46067abb
nethack-browser-bundle	wasm32	built	7bfce76f
rootfs	wasm32	built	5bb534c7
shell	wasm32	built	07edd490
lamp	wasm32	built	d4783536
node-vfs	wasm32	built	52d48e6a
wordpress	wasm32	built	3a6cd405

_{Auto-generated; replaced on each push. Raw data in the publish-status workflow artifact.}