shell: I/O redirection (>/<) and pipes (|); rewrite shell in C

- kernel I/O routing: PCB gains PROC_STDIN/PROC_STDOUT (default console $FF),
  inherited across fork. KGetc/KPutc route read/write/putc to the console or a
  file fd. New syscalls: putc(16), setin(17), setout(18), lookup(19).
  read/write now go through the routing; putc/puts/nl use SYS_PUTC.
- sys_lookup + NameTable move command-name resolution into the kernel.
- shell rewritten in C (c/sh.c): tokenizes a line, parses > / < / |, and drives
  fork+setin/setout+exec+wait. Pipes run as 'a > __pipe ; b < __pipe' (temp
  file). asm shell + cmdtab removed; StrEqual/SkipName kept for sys_lookup.
- libc: fork/exec/wait/setin/setout/lookup wrappers.
- verified: echo>file, cat file, wc<file, cat readme|wc -l, echo ...|wc.

1 files changed, 25 insertions, 12 deletions

diff --git a/README.md b/README.md
index 85a01d2..b0a2edf 100644
--- a/README.md
+++ b/README.md
@@ -58,22 +58,33 @@ across a syscall (`push hl` / `pop hl`). Libc syscall stubs handle this for C.
 | 2 | read    | ✅ blocking console input (1 byte) via external-clock serial |
 | 4,5,9,10 | open/close/kill/brk | ⛔ `ENOSYS` |
 
-### The shell (PROG_SH)
+### The shell (`c/sh.c`)
 
-init `exec`s a tiny shell: **prompt → read a line (with echo) → match a command
-→ `fork`+`exec`+`wait`**. Commands live in a table (`worker`, `hello`). Runs
-entirely over the headless serial console:
+init `exec`s the shell (written in C). It reads a line, tokenizes it, and runs
+commands with **I/O redirection and pipes**:
 
 ```
-$ hello
-hello world!
-$ worker
-worker!
-$ foo
-?
-$
+$ echo hello > note          # redirect stdout to a file
+$ cat note
+hello
+$ wc < note                  # redirect stdin from a file
+1 1 6
+$ cat readme | wc -l         # pipe (via a temp file)
+2
+$ echo one two three | wc
+1 3 14
 ```
 
+Operators must be space-separated (`cat readme > out`). Command names are
+resolved by the kernel (`sys_lookup` + `NameTable`).
+
+**How I/O routing works.** Each process has a `stdin`/`stdout` fd in its PCB
+(default `$FF` = console). `read`/`write`/`putc` route through the kernel
+(`KGetc`/`KPutc`): console when the fd is `$FF`, otherwise the filesystem
+(`getb`/`putb`). The shell forks a child, the child `setin`/`setout`s to open
+files, then `exec`s — so the program's I/O lands in the file. A pipe
+`a | b` is run as `a > __pipe ; b < __pipe ; rm __pipe`.
+
 ### Process lifecycle (exit / wait / reaping)
 
 The classic Unix zombie/reap dance, adapted to banked memory:
@@ -295,7 +306,9 @@ $ rm notes
 - [x] `wc`, `head`, and an `argc/argv` demo (`args`) + `argv_parse` in libc
 - [x] option parsing (`hasflag`/`optval`): `wc -l/-w/-c`, `head -n N`
 - [x] a RAM filesystem (WRAMX) + `ls`/`cat`/`save`/`rm`; `wc`/`head` read files
-- [ ] more tools (`rev`, `grep`, `tail`), shell redirection (`>`/`|`)
+- [x] shell in C with redirection (`>`/`<`) and pipes (`|`, via a temp file)
+- [x] per-process stdin/stdout routing (`KGetc`/`KPutc`, `setin`/`setout`)
+- [ ] more tools (`rev`, `grep`, `tail`), true concurrent pipes
 - [ ] battery-backed files (move the FS to cart SRAM), directories
 - [ ] Preemptive scheduling: real context save in `TimerISR` → `hSwitchTo`
 - [ ] Use the `$D000-$DFFF` u-area (SVBK) for per-process kernel state / kstack