std: restructure — std/ modules, namespace tail, std/xml.sx

allocators/fs/process/socket/log/trace/test move under modules/std/
(allocators.sx becomes std/mem.sx; the Allocator protocol moves into
the std.sx prelude, impls stay in mem.sx). New std/xml.sx holds
xml_escape as xml.escape. std.sx gains the carried namespace tail —
flat-importing std.sx now also provides mem./xml./log. — with the
remaining modules (fs/process/socket/json/cli/hash/test) deferred from
the tail until the global last-wins maps are fully own-wins (pulling
them into every closure collides bare names corpus-wide; they stay
direct imports: modules/std/fs.sx etc.). log.sx's internal emit
renamed log_emit (it clobbered consumer fns named emit program-wide).
bundle.sx uses xml.escape via the carried alias. Consumer import paths
swept mechanically; .ir snapshots recaptured for the larger std
closure. m3te + game build unchanged.

library/modules/std/xml.sx

@@ -0,0 +1,32 @@
+// XML helpers. `escape` replaces XML special characters with entity
+// references — used when emitting Info.plist / AndroidManifest content
+// from sx values that may contain user-supplied text.
+#import "modules/std.sx";
+
+escape :: (s: string) -> string {
+    result := "";
+    i := 0;
+    seg_start := 0;
+    while i < s.len {
+        c := s[i];
+        // 38='&', 60='<', 62='>', 34='"', 39='\''
+        ent := "";
+        if c == 38 { ent = "&amp;"; }
+        if c == 60 { ent = "&lt;"; }
+        if c == 62 { ent = "&gt;"; }
+        if c == 34 { ent = "&quot;"; }
+        if c == 39 { ent = "&apos;"; }
+        if ent.len > 0 {
+            if i > seg_start {
+                result = concat(result, substr(s, seg_start, i - seg_start));
+            }
+            result = concat(result, ent);
+            seg_start = i + 1;
+        }
+        i += 1;
+    }
+    if seg_start < s.len {
+        result = concat(result, substr(s, seg_start, s.len - seg_start));
+    }
+    result
+}