Add dynamic interpreter handoff to ELF load plan and enforce bounded-filesystem capacity

[thanks-cohn]

Motivation

• Provide an explicit interpreter-handoff surface so ET_DYN/PT_INTERP images can be validated and handed to a userspace interpreter without performing relocation while preserving the original strict static plan contract for ET_EXEC only.
• Prevent invalid FileSystem compile-time configurations by rejecting zero object_capacity and capacities that exceed the u16 ObjectId namespace to avoid @enumFromInt truncation and invariant violations.

Description

• Add DynamicLoadPlan and planDynamic to projects/54-bounded-elf64-load-plan, including interpreterPath accessor, new interpreter-related errors (InterpreterPathMissingTerminator, InterpreterPathContainsNul, InterpreterPathTooLong), and logic to own/validate a single NUL-terminated PT_INTERP pathname while retaining PT_DYNAMIC for the interpreter (no relocation performed).
• Wire the dynamic handoff into the exec staging: change ExecPlan.prepare in projects/59-bounded-address-space-exec-image to derive PT_INTERP from the main image via planDynamic, validate and load the interpreter bytes with planDynamic, and select the correct entry (main_entry vs interpreter entry) without widening the static plan acceptance.
• Enforce compile-time capacity invariants in projects/58-bounded-filesystem/src/bounded_filesystem.zig with @compileError for object_capacity == 0 and object_capacity > (u16::MAX + 1), add two compile_fail fixtures, and add tools/check-bounded-filesystem-capacity.py to assert the compiler rejections.
• Regenerate metadata and public surfaces (generated/*, details.json, DETAILS.md, MASTERY.md, README.md, port.js) to expose the new public symbols and update validation evidence and build/test wiring.

Testing

• Ran repository validation and build checks: zig build check --summary all passed (all steps) and python3 tools/developer-command.py validate-repository passed the full pipeline under Zig 0.14.0.
• Exercised unit and smoke tests: zig build test-bounded-elf64-load-plan and zig build test-bounded-address-space-exec-image ran and their bundled tests (including new dynamic handoff tests) passed.
• Verified filesystem compile-time rejections with PYTHONDONTWRITEBYTECODE=1 python3 tools/check-bounded-filesystem-capacity.py, which confirmed both compile-fail cases (2/2) as expected.
• Updated generated validation evidence (modules/endpoints/public-symbols) was produced as part of the synchronization and checked by the above validation steps.

---

Codex Task