coro: activate deferred syscall replacements from requests

[cpunion]

Summary

• prepare the exact native syscall handoff and replacement slot without consuming a physical M
• add a pointer-free one-word dispatch gate whose request/return race decides whether to start that replacement
• route durable native source requests through one common physical tail after doorbell publication
• close the direct-channel cross-route liveness cycle without timer, poll, worker, or an eager runtime waiter
• document the race protocol, validation boundary, and measured temporary overhead

Validation

• go test -p=1 -timeout=180s ./... in runtime/
• go test -p=1 -timeout=180s ./cl -run 'Coro.*(Worker|Syscall)|Worker.*Coro|Syscall.*Coro'
• deferred handoff state/race tests, 10 repeats
• direct-channel and same-route channel/timer/poll replacement linked E2Es, 10 repeats
• complete go test -p=1 -timeout=600s ./internal/build -run '^TestCoro' -count=1

The direct 500-operation syscall fixture is +6.7% versus the parent (about 95 ns per syscall); the standard os.File path is neutral. No physical M is started on the fast return path. Stripped size is +79,088 bytes (~1.1%).

A pre-existing LockedOrdinarySuspend abort flake was isolated against the merge parent: the parent failed 1/20 with the same bare abort. The final complete candidate run passed.