TLS13-C11: make the consumer's target a parameter, and gate the live hop

[drawmeanelephant]

Two changes that belong together because one enables the other.

1. FETCHS.BIN takes its target from argv

exec FETCHS.BIN [ipv4 [port [server-name]]], defaulting to 10.0.0.2:443 as leaf.example.com.

A hardcoded 443 meant any live test needed the runner to run as root — which is how a test quietly stops testing.

The rules live in lib/tls/target.zig rather than in the binary, because the binary links the kernel ABI and cannot be host-tested. Dotted-quad parsing rejects empty octets (including a trailing dot), a fifth octet, values over 255, and anything that is a name; ports reject 0, overflow and junk.

zig test user/src/lib/tls/target.zig  -> 3/3 pass
zig build test                        -> 200/200 steps, 3599/3599 tests
zig build                             -> FETCHS.BIN, 239176 B image, 3 PT_LOAD segments

2. tools/gate/specs/live-tls13.spec — the class-B gate

The hop the interop matrix cannot reach: a host-side responder (tlsresponder.py, #1290) serves the fixture identity on 0.0.0.0:24533; the guest execs FETCHS.BIN against the gateway; the serial must carry the whole chain of events through to the response body. The responder's anchor is byte-identical to the vendored blob FETCHS.BIN carries, so the guest validates against its own pinned root rather than a test-only bypass.

This spec is an experiment, not a proven artifact

It could not be run before commit — a boot is exactly what it needs. It is here because the only way to learn whether the guest-side plumbing lines up is to run it in CI, where VZ exists.

If it fails, the failure is the finding. Known unknowns, in the order I'd expect them to bite:

1. Whether the guest's TCP can dial the host gateway on a high port (the 10.0.0.2 convention from fetch.zig/download.zig).
2. Whether ui.sys_time() returns a real epoch under VZ — FETCHS.BIN deliberately refuses to check validity without a clock rather than guessing.
3. Whether the responder outlives vgate_setup_python and the boot.

If it reds, the spec comes out and this PR keeps the argv work, which stands on its own.