io_uring: add opcodes, CQ backlog, cancellable poll, timer-based timeout

[gburd]

Summary

Builds on the merged core/io_uring.cc base to close fidelity gaps against the Linux io_uring ABI:

• Opcodes: adds FTRUNCATE, SPLICE, SYNC_FILE_RANGE, READ_FIXED/WRITE_FIXED, and MSG_RING; the opcode table is extended to IORING_OP_LAST.
• CQ overflow: replaces the drop-and-count behavior with a std::deque backlog (IORING_FEAT_NODROP), drained via flush_cq_overflow_locked() through a centralized io_uring_post_cqe_locked(); the SQ CQ_OVERFLOW flag is tracked.
• POLL_ADD: sliced 100ms cancellable ::poll that honors thread interruption and ring shutdown so POLL_REMOVE/ASYNC_CANCEL yield -ECANCELED.
• TIMEOUT: io_uring_deadline() (ABS/BOOTTIME/REALTIME) backed by sched::timer and the wait_cq waitqueue, replacing the 1ms busy-poll while keeping the NULL/negative-timespec validation from the hardening pass.
• enter/register: EXT_ARG enter timeout, feature-bit honesty, R_DISABLED gating, and IOWQ_MAX_WORKERS reporting.

Ring head/tail/flags reads/writes use the io_uring_au32 atomic member API; the Linux-ABI buf_ring tail stays a plain uint16_t accessed via __atomic builtins.

Test plan

• core/io_uring.cc compiles clean against the enhanced include/osv/io_uring.h.
• tests/tst-io_uring.cc (all opcode and fidelity cases) compiles clean and passes under x86_64.