Add interrupts, memory caps, async streaming, ETF callback results

Bump vsn to 4.0.0 and date the CHANGELOG entry. Major release: callback
results returning an Erlang string now arrive in Python as a list of
integers, matching call arguments, and nothing raises on upgrade.

py_context:start_loop/stop_loop/loop_ref/submit/submit_await and the
erlang.server helper let Erlang run N owngil workers that serve TCP/UDP
on a socket Erlang bound (py:dup_fd per worker) or adopt accepted fds,
and inject coroutines into the running loop.

Fixes: owngil contexts had no ErlangEventLoop and returned the main loop
from context_get_event_loop; owngil dispatch blocked on a dirty scheduler
with a 30 s cap; transports closed fds still in the poll set; READ re-arm
from the loop thread crashed in enif_select; recycled call_soon handles
cancelled by their previous owner; task start failures dropped silently.

A mode where Python code cannot take the node down or run forever:
one child process per context over a Unix socket, signals with
SIGKILL as backstop, rlimits and cgroups, restart on crash. Same
public API; the context process is a gen_statem serving one caller
at a time. Validated on macOS and FreeBSD. Version 4.2.0.

Add isolated context mode: CPython in a child OS process

Bulk data between Erlang and Python contexts no longer has to cross the
socket: py_shm regions are files mapped MAP_SHARED on both sides (no copy
on the Erlang side, one copy when Erlang writes), usable as plain terms in
any context mode, and py_buffer:new(#{shared => true}) is a streaming
input buffer over such a region with ring backpressure, so wsgi.input
works in isolated contexts. iommap is an optional dependency. Read-only
handles keep a callee from writing into a region.

Add shared memory regions and shared buffers over iommap

A map of the code: processes and threads, the life of a call in each
context mode, the paths Python uses to call Erlang, which code is live and
which is legacy, and one meaning per overloaded word (worker, context,
pool). The stale file list in the NIF headers now points at these pages.
Also completes the 4.2.0 changelog.

Add architecture, code map and glossary

Contexts are the only execution path; the per-worker NIFs, the single
executor thread they ran on, the deprecated async worker NIFs, the unused
worker pool, the cancel aliases and the unreachable inline executor
branches of the context NIFs are gone (about 3,000 lines). This removes
public NIF functions, so the open release becomes 5.0.0. memory_stats and
gc run under the GIL on the calling scheduler. The generator example uses
py:stream.

The py_context_t header still described dirty-scheduler execution
over a shared-GIL pool. It now says which thread owns each field
group, what each mutex guards, the lock order, and why a stuck
context is leaked rather than freed. The event loop struct gets the
same treatment, and the Erlang modules that own a resource state in
three lines what they own, who they talk to and what they never do.

Every message, frame and status code now has one page saying who
sends it, what answers it and which files must change together,
and every long-lived process and thread has its states, triggers
and timers written down next to the invariants a change must keep.

select() is undefined for a descriptor above FD_SETSIZE, so a VM
with more than 1024 open files could not bring up a thread worker
and every thread callback after that failed with "Failed to spawn
thread handler". The ready-wait also releases the GIL, and the
coordinator logs a failed ready signal instead of leaving Python
to time out.

Build, test, the FreeBSD VM, and one recipe per kind of change
(a NIF, an erlang.* function, a context option, a suite, a guide)
listing every file that change touches, so a contributor can
finish a change without reading the whole tree first.

Eight records, one per design decision that shapes the code today,
each with the situation, what was decided, what it costs and where
the code is, so a change that reverses one is made knowingly.

One dispatcher for every context request in C, one NIF table entry
list per area, one process body module per mode on the Erlang side,
and a py facade that delegates streaming, venvs and shared dicts to
their own modules. The thread functions and flags are named for
what they are rather than for the worker mode they came from. No
public API changes.

A script, run by make and CI, that fails when a source file is
missing from docs/code-map.md, an Erlang module has no moduledoc,
or a module has no row in the new Modules table of the coverage
audit. Running it once found two modules, seven headers and two
Python files the map had missed.

Isolated mode bounded what Python could consume but nothing it could
reach: the child held every authority the node's user held. The caps
option names its directories, environment and addresses, and refuses
the rest. The model and its vocabulary come from erlang_wasm's WASI
implementation, so a grant means the same thing in both.

It is a cooperative policy over Python, not a boundary: built on an
audit hook, it binds Python and not a C extension, and covers only
what CPython announces. The guide says what holds and what does not,
and names the kernel work that would change the answer.

Enforcing what a child may reach from inside CPython does not
work: an audit hook never sees a C extension, and the open event
does not say which directory a relative path resolves against, so
the containment could be walked around with documented calls. The
tree returns to 5.0.0 and the guides say plainly that the child
holds every authority the node's user holds, with the operating
system mechanisms that do bound it.