feat: implement kvmgr_capture_keys for lock-free checkpoint serialization (P0-14a)

Add kvtab_foreach walk primitive (P0-14) to kv.c/kv.h, then implement
kvmgr_capture_keys in kvmgr.c that deep-copies all key→index mappings
into a malloc'd slot_key_t[] array safe to read after the write lock is
released during checkpoint serialization (Part 3.8).

Key design points:
- Both kvtab_foreach and kvmgr_capture_keys take var (RTTI data pointer)
  and use RTTI_DATA_TO_OBJ internally — the RTTI framework's makeInstance
  returns the data region pointer, not the meta_obj_t header pointer
- String keys are copied via strncpy into slot_key_t.key[XCE_MAXNAME_LEN]
- Integer keys are formatted as decimal strings via snprintf
- Two-pass approach: count live entries first, allocate, then fill
- Tests cover string kvmgr (3 entries), empty kvmgr, and deep-copy safety

src/include/kv.h

@@ -30,4 +30,22 @@ extern kv_key_ops_t int_key_ops;
 extern kv_key_ops_t string_key_ops;
 
 extern int key_cmp_default(void*, void*, size_t);
+
+/*
+ * kvtab_foreach — iterate every live entry in the kvtab (P0-14).
+ *
+ * For each entry, cb(key, index, arg) is called.
+ * - key   : the raw key pointer stored in the entry (char* for
+ *           string-keyed tables, (void*)(long)intval for int-keyed).
+ * - index : the slot index stored as the entry value.
+ * - arg   : caller-supplied context.
+ *
+ * Iteration order is unspecified.
+ * Returns the number of entries visited, or -EINVAL if kvtab is NULL.
+ */
+typedef void (*kvtab_foreach_fn_t)(void* key, int index, void* arg);
+extern int kvtab_foreach(var                kvtab,
+                         kvtab_foreach_fn_t cb,
+                         void*              arg);
+
 #endif