feat: TLS runtime - PT_TLS loading and per-thread FS base

MontaukOS binaries could not use thread-local storage: the ELF loader
ignored PT_TLS and no FS base was ever programmed, so any %fs access
(initial-exec/local-exec TLS, e.g. libbfd's _Thread_local error state)
page faulted at address 0. This is the kernel prerequisite for
cc1plus/libstdc++ in the GCC port.

ELF loader: parse PT_TLS and build the main thread's TLS block above
the loaded image (x86-64 variant II ABI: block below the thread
pointer, TP = base + align_up(memsz, align), .tdata copied from the
template, .tbss zeroed, ABI self-pointer stored at [TP]). The
template description is kept on the process for thread spawns.

Scheduler: fsBase per thread, loaded into IA32_FS_BASE at every
dispatch site through a per-CPU cache - TLS-free processes cost one
MSR write per CPU ever, and userspace cannot desync the cache since
CR4.FSGSBASE stays off. SYS_THREAD_SPAWN gives each new thread its
own TLS block copied from the template (allocated from the process
heap; reclaimed at process teardown).

Ships tls-test.elf in the SDK (built by the devkit target): checks
.tdata values, .tbss zeroing, and the %fs:0 self-pointer, exiting
nonzero on failure. Boot-smoke verified; existing TLS-free programs
are unaffected.

Co-Authored-By: Claude Fable 5 <[email protected]>

kernel/src/Sched/Scheduler.hpp

@@ -58,6 +58,16 @@ namespace Sched {
         char user[32];            // Owner user name (inherited from parent on spawn)
         char cwd[256];            // Absolute current working directory
 
+        // Thread-local storage. fsBase is loaded into IA32_FS_BASE when
+        // this thread is dispatched (0 = no TLS). The tls* template fields
+        // live on the primary slot and describe PT_TLS so sibling threads
+        // can get their own block copies.
+        uint64_t fsBase = 0;
+        uint64_t tlsTemplateVaddr = 0;
+        uint64_t tlsFileSize = 0;
+        uint64_t tlsMemSize = 0;
+        uint64_t tlsAlign = 0;
+
         int runningOnCpu;         // CPU index running this process (-1 if not running)
         bool killPending = false; // Set by Sys_Kill when target is running on another CPU
         bool reapReady = false;   // Set once teardown is complete and BSP may free slot resources