reactor: a ring the kernel refuses reaches OnFault instead of ending the process

[MDA2AV]

Fixes #270

Ring.Create ran outside the try that hands faults to OnFault ("nothing to tear down until it returns"), so a host that set OnFault still lost the process when io_uring_setup failed - the WSL2 5.15 case in the issue. It now has its own catch: OnFault gets the exception and Run returns. A host without OnFault still gets it thrown out of Run, as OnFault documents.

The message now names the cause instead of a bare errno:

• kernel older than 6.1: io_uring_setup failed with errno 22 for a ring of 8192 entries on Linux 5.15.167.4-microsoft-standard-WSL2: the kernel does not know SINGLE_ISSUER | DEFER_TASKRUN, and ioxide needs Linux 6.1 or later.
• more than 32768 entries: ...: the kernel allows at most 32768 (ServerConfig.RingEntries).
• EPERM: io_uring disabled by the kernel.io_uring_disabled sysctl or a seccomp profile (a container runtime's default). ENOSYS: built without io_uring. ENOMEM keeps its memlock advice.

Tests

• reactor: a ring the kernel refuses reaches OnFault instead of ending the process: 65536 entries is EINVAL on every kernel. On main it fails with the refused ring was thrown out of Run past OnFault ... io_uring_setup failed with errno 22; passes here.
• ring setup: ... (Unit, 3): the message for an old kernel, for too many entries, and for EPERM.

All suites pass: E2E 232, Unit 63, Chaos 47, Http 44, Tls 151 (the 7 kTLS tests skip without sudo), File 4. Startup only, so no bench.

Not done: a probe a host could call before starting any thread (the issue's other suggestion). OnFault already reports the failure, so I left the API surface alone - say if GenHTTP wants one to fall back before spawning reactors.