feat: std.time — wall + monotonic clocks over clock_gettime (PLAN-HTTPZ S1)

now_secs (CLOCK_REALTIME, epoch seconds) and mono_ms (CLOCK_MONOTONIC,
process-local milliseconds for deadlines). Clock ids are darwin's; the
per-OS selection mechanism is PLAN-HTTPZ C3. No error channel: with
module-constant clock ids and a stack timespec, clock_gettime is total.
std.sx namespace tail carries the time alias; examples/1629 pins epoch
plausibility, monotone advance, and the alias carry.

examples/1629-std-time.sx

@@ -0,0 +1,35 @@
+// std.time (PLAN-HTTPZ S1): the wall clock reads a plausible epoch and
+// the monotonic clock advances and never runs backwards. The `time`
+// alias rides the std.sx namespace tail like its siblings.
+#import "modules/std.sx";
+
+main :: () -> i32 {
+    now := time.now_secs();
+    if now < 1767225600 {            // before 2026-01-01: implausible
+        print("wall clock implausibly old: {}\n", now);
+        return 1;
+    }
+    if now > 4102444800 {            // after 2100-01-01: implausible
+        print("wall clock implausibly far: {}\n", now);
+        return 1;
+    }
+
+    a := time.mono_ms();
+    b := a;
+    spins := 0;
+    while b == a and spins < 100000000 {   // a real ms tick arrives long before the bound
+        b = time.mono_ms();
+        spins += 1;
+    }
+    if b < a {
+        print("monotonic went backwards: {} -> {}\n", a, b);
+        return 1;
+    }
+    if b == a {
+        print("monotonic never advanced\n");
+        return 1;
+    }
+
+    print("std.time ok\n");
+    return 0;
+}

examples/expected/1629-std-time.exit

@@ -0,0 +1 @@
+0

examples/expected/1629-std-time.stderr

@@ -0,0 +1 @@
+

examples/expected/1629-std-time.stdout

@@ -0,0 +1 @@
+std.time ok

library/modules/std.sx

@@ -97,3 +97,4 @@ cli     :: #import "modules/std/cli.sx";
 hash    :: #import "modules/std/hash.sx";
 log     :: #import "modules/std/log.sx";
 test    :: #import "modules/std/test.sx";
+time    :: #import "modules/std/time.sx";

library/modules/std/time.sx

@@ -0,0 +1,44 @@
+// std.time — wall and monotonic clocks over clock_gettime(2)
+// (PLAN-HTTPZ S1).
+//
+//   now_secs()  wall clock, unix epoch seconds (CLOCK_REALTIME).
+//   mono_ms()   monotonic milliseconds for deadlines/timeouts —
+//               unaffected by wall-clock steps (NTP, manual set);
+//               meaningful only as a difference between two reads in
+//               one process, never as an absolute time.
+//
+// PER-OS: clock ids differ (CLOCK_MONOTONIC is 6 on darwin, 1 on
+// linux); the constants below are darwin's. Per-OS selection is
+// PLAN-HTTPZ C3 — until it lands this module is correct on the gate's
+// host (darwin) only.
+//
+// No error channel: clock_gettime fails only on an unknown clock id
+// (ours are module constants) or a bad pointer (ours is a stack slot),
+// so the wrappers are total.
+
+libc :: #library "c";
+
+// darwin struct timespec: tv_sec and tv_nsec are both C long (i64).
+Timespec :: struct {
+    sec: i64;
+    nsec: i64;
+}
+
+clock_gettime :: (clock_id: i32, ts: *Timespec) -> i32 #foreign libc;
+
+CLOCK_REALTIME  :i32: 0;
+CLOCK_MONOTONIC :i32: 6;   // darwin; linux is 1 (C3 selects per-OS)
+
+// Wall clock as unix epoch seconds.
+now_secs :: () -> i64 {
+    ts : Timespec = .{};
+    clock_gettime(CLOCK_REALTIME, @ts);
+    return ts.sec;
+}
+
+// Monotonic milliseconds since an arbitrary process-local origin.
+mono_ms :: () -> i64 {
+    ts : Timespec = .{};
+    clock_gettime(CLOCK_MONOTONIC, @ts);
+    return ts.sec * 1000 + ts.nsec / 1000000;
+}