sync: hand the RWMutex over instead of a re-test of the reader count

What this does

sync.RWMutex counts the readers that hold the lock and the readers that queue
behind a waiting writer in one number, and both sides wait on a predicate over
that number. Two interleavings stop the program permanently.

1. A writer waits until the count shows no readers at all. A reader that arrives
   during that wait joins the same count, so the last holder of the lock no
   longer sees the condition that wakes the writer.
2. A reader that Unlock releases reads the count again instead of an acquire.
   A writer that arrives in between changes the base of the count, so the reader
   goes back to sleep after its wakeup is spent, while that writer waits for it.

Both cases end with every party parked and nobody left to wake anyone.

The change adopts the split that the Go standard library uses. A writer records
how many readers it finds and waits only for those, so later readers cannot
starve it. Counting semaphores hand the lock over, so a released waiter holds
the lock and does not test a value again that a third party can change back.
internal/task.Semaphore cannot do this, because one Post does nothing when
there are several waiters, so src/sync/mutex.go gets a small futex semaphore
that can.

Why it matters

Ordinary code reaches this. syscall.ForkLock is an RWMutex, os.Pipe
read-locks it and os.StartProcess write-locks it, so a program that starts
processes and makes pipes at the same time can stop.

Evidence

Two regression tests are added to src/sync/mutex_test.go. sync is already in
TEST_PACKAGES_FAST, so they run on every platform that the standard library
test matrix covers, with no makefile change.

Measured on macOS 26.6 arm64 with tinygo test sync.

The same shape was seen with real work. A probe that starts sixteen processes
at the same time and gives each one a pipe stopped within twelve seconds on
every run before this change, and completed on twenty runs out of twenty after
it, on linux and on macOS.

A downstream product also ships binaries built with a fork that carries this
change, in the published release dispat v1.4.0.
https://github.com/yohimik/dispat/releases/tag/services%2Fdispat%2Fv1.4.0

Scope

• No API change.
• The cooperative, threads and cores schedulers all use internal/task.Futex,
  so no path is special-cased.
• Windows, wasm and baremetal targets get the same code and the same tests.

Notes for review

• rwSem is small on purpose. If the maintainers would rather have a counting
  semaphore in internal/task next to Semaphore, it can move there.
• Unlock now reports "sync: Unlock of unlocked RWMutex" through
  runtimeFatal, which the old code did not do. Say if that check is unwanted.

Related pull requests

Each open PR in this series has a separate change. A dependency is not a copied commit.

• sync: hand the RWMutex over instead of a re-test of the reader count #5630 fixes RWMutex handover.
• runtime: deliver os/signal notifications under the threads scheduler #5631 is closed in favor of runtime: deliver signals under the threads scheduler when blocked on I/O #5530, owned by @0pcom. The fork still uses the tested runtime: deliver os/signal notifications under the threads scheduler #5631 implementation until a replacement is checked.
• compiler,runtime: call fcntl through a C wrapper on darwin #5632 is closed in favor of compiler: implement go:cgo_import_dynamic and lower Darwin cgo import trampolines (#5604) #5612, owned by @neomantra. compiler: implement go:cgo_import_dynamic and lower Darwin cgo import trampolines (#5604) #5612 covers both stdlib and x/sys Darwin trampolines.
• runtime: implement weak.runtime_makeStrongFromWeak #5633 provides the weak-pointer runtime hook.
• os: start processes with posix_spawn #5634 provides process spawning and process state. Darwin also needs compiler: implement go:cgo_import_dynamic and lower Darwin cgo import trampolines (#5604) #5612 and builder: declare Darwin socket and process symbols #5636. Concurrent use needs sync: hand the RWMutex over instead of a re-test of the reader count #5630.
• loader: use the real crypto/tls on hosted linux and darwin #5635 selects software TLS on hosted Linux and Darwin. It needs runtime: implement weak.runtime_makeStrongFromWeak #5633. The overlapping crypto/tls: use Go's software TLS on the host target #5645 is under discussion with @0pcom.
• builder: declare Darwin socket and process symbols #5636 provides the Darwin socket and process link symbols. It does not include process or TLS implementation changes.

In tinygo-org/net

• net/http: follow redirects in the client again net#72 restores HTTP redirects. It shares http/client.go with the timeout work in http: port Go net/http timeout handling net#67, so the two changes need integration review.
• net: report a name that does not exist as a not-found lookup error net#73 preserves DNS not-found errors.
• net: extend the host netdev to darwin net#74 adds Darwin host netdev support. It shares the host netdev with net: non-blocking host netdev I/O with an epoll poller net#77. Linux epoll and Darwin support must remain separate.
• net/http: give the HTTPS client trust roots on darwin net#75 supplies Darwin trust roots to the HTTP client.
• net: non-blocking host netdev I/O with an epoll poller net#77 owns Linux cancellation and deadline work, net: report the kernel-assigned port after listening on port 0 net#80 owns port-zero reporting, and net/http: add ListenAndServeTLS / ServeTLS (software TLS) net#79 owns HTTP server TLS. These are separate contributors' changes, not completed parts of this series.
• net: API-compat fills for grpc and wazero (SyscallConn, Dialer.Control, IPConn.Read) net#78 adds client API fields and related compatibility methods.

Full Darwin networking also needs the merged net changes and a later src/net pin update. No upstream merge or current full-suite pass is implied by this list.

Additional independent gaps found in Crier are covered by #5655 (cookie-jar loader merge) and tinygo-org/net#82 (ListenConfig). They do not duplicate the process, TLS, deadline or server-TLS changes above. Current Crier comparison work is separate from its standard-Go release.

Current Crier evidence

The Crier report separates the original size comparison from a new CI-built candidate test. The original stripped Linux ARM64 result is 13,829,248 bytes versus Go's 30,277,794 bytes. Two render fixtures exceed pixel tolerance.

Candidate e7d34c8c126e0eecd2ce711915f2f88d112d833a, with net 0f460803, passed all 24 fork CI checks. Its downloaded compiler artifacts, with no source overlays, build unchanged Crier 7edaff9. Linux ARM64 E2E passed 143 cases with no failures or skips. Darwin ARM64 passed 142 with no failures and one platform trust-store skip. Darwin startup now works. A separate Darwin local-TLS matrix passes certificate rejection, plaintext refusal, update to a Go 1.1.0 target, and offline rollback. Both platforms pass spawn, signal, cookiejar, os/fcntl, and network probes.

These are combined-candidate results, not proof that this PR alone supplies all features. No new pixel or stripped-size comparison, amd64 execution, or current Dispat acceptance is claimed. WaitDelay and the recorded net limits remain open. No fork release was published.