feat: preprocess native argv into sentinel slices

README.md

@@ -24,14 +24,15 @@ main func(init process.Init) void {
 }
 ```
 
-`Init` contains `io io.Io` and `args process.Args`. `Args.values` is a borrowed
-`[][*;0]u8` view of native `argv`, with its length taken from `argc`: it includes
-the executable name at index 0 when present, without copying strings or the
-pointer array. `process.argument_count(init.args)` returns that count, and
-`process.argument(init.args, index)` returns a borrowed `?[;0]u8` (null when out
-of range). The helper scans only the requested zero-terminated argument; empty
-arguments remain empty slices. The slices are valid while their supplied
-argument storage lives.
+`Init` contains `io io.Io` and `args process.Args`. `Args.values` has type
+`[][;0]u8`: use `init.args.values.len` for the count and
+`init.args.values[index]` for a borrowed, zero-terminated argument slice.
+Index 0 is the executable name when present, and empty arguments are empty
+slices. Startup scans each native argument once and allocates only the slice
+descriptors; argument strings are never copied. The native entry wrapper owns
+the descriptors until `main` returns, freeing them on both success and error.
+An empty native argument list is supported; allocation overflow or failure exits
+with status 2. Parameterless `main` does not prepare unused arguments.
 
 Bodyless `c_func` declarations bind exact external symbols and require concrete
 types. C primitives use atomic target-dependent names and remain semantically