feat(select): fd arms in select + timed fd waits (RFC 008 phase 1)

FdArm composes fd readiness with channel arms on one wait epoch.
Selectable grows fallible sel_register and an eager-cleanup hook;
losing/stop-unwound/timed-out fd arms are unregistered (waiters entry
+ kernel ONESHOT) so the fd is never poisoned. try_select /
try_select_timeout surface registration errors (EBADF, EMFILE,
AlreadyExists) instead of RFC 008's permanently-ready lean, which
would busy-loop a healthy-but-unregistrable fd; select/select_timeout
stay infallible for channel-only arms. Adds wait_readable_timeout /
wait_writable_timeout as one-arm selects.

Known benign race (pre-existing, slightly widened): a queued FdReady
racing the cleanup DEL can spuriously wake a fresh waiter on that fd;
absorbed by select's defensive re-loop. Fixable by epoch-stamping
completions.

src/scheduler.rs

@@ -432,6 +432,138 @@ fn wait_fd(fd: std::os::fd::RawFd, readable: bool, writable: bool) -> std::io::R
     Ok(())
 }
 
+// ---------------------------------------------------------------------------
+// FdArm — fd readiness as a select arm (RFC 008)
+// ---------------------------------------------------------------------------
+
+/// An fd-readiness arm for [`crate::select`] / [`crate::select_timeout`]:
+/// ready when the fd is readable (resp. writable), composable with channel
+/// receivers on one wait epoch. Phase-1 rules apply: one waiter per fd at a
+/// time, one direction per arm (duplex on a single fd needs `dup`; epoll
+/// registrations key on the open file description, so dup'd fds register
+/// independently).
+pub struct FdArm {
+    fd: std::os::fd::RawFd,
+    readable: bool,
+    writable: bool,
+}
+
+impl FdArm {
+    pub fn readable(fd: std::os::fd::RawFd) -> Self {
+        FdArm { fd, readable: true, writable: false }
+    }
+
+    pub fn writable(fd: std::os::fd::RawFd) -> Self {
+        FdArm { fd, readable: false, writable: true }
+    }
+}
+
+impl crate::channel::sealed::Sealed for FdArm {}
+
+impl crate::channel::Selectable for FdArm {
+    /// Ready-now check is a zero-timeout `poll(2)`; if the requested events
+    /// are pending the wait is retired without registering (`Ok(false)`,
+    /// the channel-arm contract). Otherwise register with the io thread —
+    /// every failure surfaces as `Err` (EBADF including a closed-fd
+    /// POLLNVAL, EMFILE on the epoll set, AlreadyExists for a second
+    /// waiter on the fd): the fallible-out, nothing-left-behind rule, in
+    /// deviation from RFC 008's permanently-ready lean, which would spin a
+    /// consumer whose fd is healthy but unregistrable (EMFILE).
+    fn sel_register(&self, pid: Pid, epoch: u32) -> std::io::Result<bool> {
+        if poll_events(self.fd, self.readable, self.writable)? {
+            return Ok(false);
+        }
+        with_runtime(|inner| {
+            let mut io = inner.io.lock().unwrap();
+            io.as_mut()
+                .expect("io thread not started")
+                .epoll_register(self.fd, pid, epoch, self.readable, self.writable)
+        })?;
+        Ok(true)
+    }
+
+    /// Classification is the same zero-timeout poll: a pure function of fd
+    /// state, independent of the registration the cleanup pass removed. An
+    /// error here (EBADF: fd closed mid-wait) reports READY — the
+    /// consumer's read/write surfaces the errno; a dead arm is an event,
+    /// not a hang.
+    fn sel_ready(&self) -> bool {
+        poll_events(self.fd, self.readable, self.writable).unwrap_or(true)
+    }
+
+    /// `wait_fd`'s `Dereg` compare, verbatim: remove the waiters entry and
+    /// kernel-side registration iff the entry is still `(pid, epoch)`-ours.
+    /// A `FdReady` racing the wake may have consumed it (it removes + DELs
+    /// under the io lock), after which the fd may even carry ANOTHER
+    /// actor's fresh registration; in that case touch nothing.
+    fn sel_unregister(&self, pid: Pid, epoch: u32) {
+        with_runtime(|inner| {
+            let mut io = inner.io.lock().unwrap();
+            if let Some(io) = io.as_mut() {
+                if io.waiters.get(&self.fd) == Some(&(pid, epoch)) {
+                    io.waiters.remove(&self.fd);
+                    io.epoll_deregister(self.fd);
+                }
+            }
+        });
+    }
+
+    fn sel_eager_cleanup(&self) -> bool {
+        true
+    }
+}
+
+/// Zero-timeout `poll(2)`: are any of the requested events (or ERR/HUP,
+/// which make the consumer's read/write fail loudly rather than park
+/// forever) pending on `fd`? POLLNVAL maps to `Err(EBADF)`.
+fn poll_events(fd: std::os::fd::RawFd, readable: bool, writable: bool) -> std::io::Result<bool> {
+    let mut events: libc::c_short = 0;
+    if readable {
+        events |= libc::POLLIN;
+    }
+    if writable {
+        events |= libc::POLLOUT;
+    }
+    let mut pfd = libc::pollfd { fd, events, revents: 0 };
+    loop {
+        let r = unsafe { libc::poll(&mut pfd, 1, 0) };
+        if r < 0 {
+            let e = std::io::Error::last_os_error();
+            if e.kind() == std::io::ErrorKind::Interrupted {
+                continue;
+            }
+            return Err(e);
+        }
+        if r == 0 {
+            return Ok(false);
+        }
+        if pfd.revents & libc::POLLNVAL != 0 {
+            return Err(std::io::Error::from_raw_os_error(libc::EBADF));
+        }
+        return Ok(pfd.revents & (events | libc::POLLERR | libc::POLLHUP) != 0);
+    }
+}
+
+/// Wait until `fd` is readable or `timeout` elapses: `Ok(true)` = ready,
+/// `Ok(false)` = timed out. A one-arm [`crate::try_select_timeout`].
+pub fn wait_readable_timeout(
+    fd: std::os::fd::RawFd,
+    timeout: std::time::Duration,
+) -> std::io::Result<bool> {
+    let arm = FdArm::readable(fd);
+    Ok(crate::channel::try_select_timeout(&[&arm], timeout)?.is_some())
+}
+
+/// Wait until `fd` is writable or `timeout` elapses: `Ok(true)` = ready,
+/// `Ok(false)` = timed out.
+pub fn wait_writable_timeout(
+    fd: std::os::fd::RawFd,
+    timeout: std::time::Duration,
+) -> std::io::Result<bool> {
+    let arm = FdArm::writable(fd);
+    Ok(crate::channel::try_select_timeout(&[&arm], timeout)?.is_some())
+}
+
 pub fn read(fd: std::os::fd::RawFd, buf: &mut [u8]) -> std::io::Result<usize> {
     wait_readable(fd)?;
     let n = unsafe { libc::read(fd, buf.as_mut_ptr() as *mut _, buf.len()) };