Provide the five interfaces openkal 0.8 added

[Sunrisepeak]

This implementation declined net, datagram, timeout, exec and space in
whole, which clause 3 permits and clause 6.1 makes honest. The consequence was
that every capability composed above them — sockets, readiness and the
duplication of the calling image, all of which openkal-musl now routes — was a
Linux capability rather than an ecosystem one.

	on this system
src/net.cpp	the kernel's own socket calls. There is no accept4 and no flag upon socket that closes a descriptor across a spawn, so close-on-exec is set afterwards; process.cpp already records what the two steps cost
src/datagram.cpp	the same calls with SOCK_DGRAM
src/timeout.cpp	poll, whose bound is stated in milliseconds. ppoll does not exist here, so a millisecond is the granularity this implementation reports — what the environment can distinguish rather than what would be convenient
src/space.cpp	the duplication primitive openkal.process was already built on
src/exec.cpp	a mapping obtained writable and made executable afterwards, which is the only order this system permits

⚠️ The duplicate is distinguished by the call's second return value. Both
images receive a process identifier in the first — the original receives the
duplicate's and the duplicate receives the original's — so an implementation
testing the first against zero, which is what the other kernel's convention
suggests, would decide that neither image was the duplicate. src/sys.h has
recorded the measurement beside that call since openkal.process was written;
this is the second use of it.

⚠️ Two constants differ from the other kernel's and would not announce it

AF_INET6 is 30 here and 10 on Linux; SOL_SOCKET is 0xffff here and 1
on Linux. A value taken from the wrong system produces a call that fails with an
ordinary error, which reads as a defect in the caller. A third difference is
structural: a socket address carries its own length in its first byte, where
the other kernel's layout puts the low half of a two-byte family.

.github/workflows/numbers.yml gains the socket calls, so their numbers keep
being read from the system's own table rather than remembered.

⚠️ Clause 6.5 names this system and openkal.exec in terms

That clause is about memory writable and executable at the same time, which
this interface does not offer: a region is writable, then published, then
executable, and never both. The conformance suite reserves a region, writes an
instruction sequence into it, publishes it, calls it, and compares what it
returned — so the reading is settled by the system rather than by an argument.
If it stops holding, the remedy is clause 6.5's: a feature provided at
dependency resolution.

The conformance run moves from full to full,optional

Which is what makes the five above examined rather than skipped. full
expands to standard,abi,stability,cost, and standard is the hosted set; the
five are in optional. No backend anywhere was selecting them.

---

This is one change across seven repositories, and every branch carries the
same name. Each repository's continuous integration substitutes its siblings'
working trees taken from the branch of the name under test, so the graph only
holds together when they agree.

repository	what it carries
openkal-musl	the socket, datagram, readiness and image-copying routes, and four probes
openkal-macos	the five interfaces 0.8 added
openkal-windows	four of the five; openkal.space declined in terms
openkal-linux	the conformance run selects the optional interfaces, which nothing did
openkal-llvm-runtime	__config_site's claims asserted by a program, and the C library repinned
openkal	the portable example's pins, and §9 of the plan
sbase	ninety-seven utilities above the new C library

The specification does not change. No interface was added, none was altered,
and SURFACE.txt is untouched — every capability below is composed from atoms
openkal 0.8 already had.