feat: implement kvmgr_capture_keys for lock-free checkpoint serialization (P0-14a)

Add kvtab_foreach walk primitive (P0-14) to kv.c/kv.h, then implement
kvmgr_capture_keys in kvmgr.c that deep-copies all key→index mappings
into a malloc'd slot_key_t[] array safe to read after the write lock is
released during checkpoint serialization (Part 3.8).

Key design points:
- Both kvtab_foreach and kvmgr_capture_keys take var (RTTI data pointer)
  and use RTTI_DATA_TO_OBJ internally — the RTTI framework's makeInstance
  returns the data region pointer, not the meta_obj_t header pointer
- String keys are copied via strncpy into slot_key_t.key[XCE_MAXNAME_LEN]
- Integer keys are formatted as decimal strings via snprintf
- Two-pass approach: count live entries first, allocate, then fill
- Tests cover string kvmgr (3 entries), empty kvmgr, and deep-copy safety

src/lib/kv.c

@@ -248,6 +248,35 @@ static int kvtab_find(meta_obj_t* obj, void* key, void** value)
     return 1;
 }
 
+/*
+ * kvtab_foreach — walk every live entry and invoke cb(key, index, arg).
+ * index is recovered by casting the stored void* value back to int.
+ * Caller must hold any necessary external lock before calling.
+ */
+int kvtab_foreach(var kvtab_var, kvtab_foreach_fn_t cb, void* arg)
+{
+    if (kvtab_var == NULL || cb == NULL) {
+        return -EINVAL;
+    }
+
+    meta_obj_t* obj = RTTI_DATA_TO_OBJ(kvtab_var);
+    kvtab_t*    t   = RTTI_OBJ_TO_DATA(kvtab_t, obj);
+    int       count = 0;
+    uint32_t  i;
+
+    for (i = 0; i < t->nslots; i++) {
+        kvent_t* e = t->slots[i];
+        while (e != NULL) {
+            int idx = (int)(long)e->value;
+            cb(e->key, idx, arg);
+            count++;
+            e = e->next;
+        }
+    }
+
+    return count;
+}
+
 typeinfo_t kvtab_type
     = { .name        = "kvtab",
         .privateSize = 0,