Validate privileged code relationships

- Work towards improving non-optimized build support
- Introduce MODE=zero which is -O0 without ASAN/UBSAN
- Use system GCC when ~/.cosmo.mk has USE_SYSTEM_TOOLCHAIN=1
- Have package.com check .privileged code doesn't call non-privileged

libc/intrin/restorewintty.c

@@ -35,7 +35,7 @@ const unsigned char kConsoleHandles[3] = {
 };
 
 // Puts cmd.exe gui back the way it was.
-noinstrument void _restorewintty(void) {
+privileged noinstrument void _restorewintty(void) {
   if (!IsWindows()) return;
   if (__imp_GetCurrentProcessId() != __pid_exec) return;
   for (int i = 0; i < 3; ++i) {