hs targets the smallest Linux-like kernels (the builder-hex0-arch stage2
family: ~18 syscalls, no dup2/pipe/stat/getdents, fd<=2 -> console, a shared-
fd-table continuation fork). Adapt hs to that contract and prove it end to end.

- tests/kernel/: a lane that boots a builder-hex0-arch kernel under QEMU,
  bootstraps stage0 in-kernel, compiles hs.c there, and runs self-checking
  probes; x86/riscv64/aarch64 CI matrix (.github/workflows/ci.yml).
- Kernel adaptations (K1-K4): in-process subshells/$()/pipes (run_isolated),
  size-as-type file tests (no stat), open_append for >> (no O_APPEND), the
  fd<=2 console model.
- Syscall contract: hs relies only on the common-denominator set; umask tracks
  its value in-process (these kernels have no umask syscall to read back).
- Redirection/capture is builtin-only. Remove the host-only external-redirect
  scaffold (exec_external_redir, REDIR_*, the g_lowfd_reuse probe): an exec'd
  program's stdout cannot be repointed (fd<=2 -> uart, no dup2). An external
  whose stdio is bound to a redirect or capture is refused with an error
  instead of run with the redirect silently ineffective; an external with no
  redirect runs normally.
- Rework the test suite to builtins where externals were only incidental and
  drop the external-redirect/capture cases. 160/160 on hs-gcc, M2-Planet, and
  /bin/sh; kernel lane 15/15 on x86, riscv64, aarch64.