Test suite cannot run on macOS: fallocate resolved at import time

## Problem

`uv run python -m pytest` fails at conftest import on macOS, so **no test in the suite can run locally on a Mac**. It is not a test failure — collection never starts.

```
ImportError while loading conftest 'tests/conftest.py'.
tests/conftest.py:48: in
import kdive.jobs.assembly as job_assembly_module
src/kdive/jobs/assembly.py:18: in
from kdive.providers.assembly.composition import ProviderComposition
...
src/kdive/providers/local_libvirt/lifecycle/rootfs/rootfs_upload_fetch.py:128: in
_fallocate = _libc.fallocate
E AttributeError: dlsym(RTLD_DEFAULT, fallocate): symbol not found
```

`fallocate(2)` is Linux-only; macOS has no such libc symbol. Resolving it at **module import** rather than at first use makes the whole import chain unusable off Linux.

Verified pre-existing on a clean `origin/main` worktree, so this is not branch-local. Found while implementing #1809.

## Evidence

- `src/kdive/providers/local_libvirt/lifecycle/rootfs/rootfs_upload_fetch.py:128` — `_fallocate = _libc.fallocate` at module scope.
- `tests/conftest.py:48` — `import kdive.jobs.assembly`, which transitively reaches it, so every test collection pays it.
- `scripts/gen_doc_constants.py` and `scripts/gen_doc_resources.py` import the same chain, so `just doc-constants-check` and `just resources-docs-check` are equally unrunnable on macOS.
- Linux CI is unaffected — the symbol resolves there.

## Expected

- `uv run python -m pytest` collects and runs on macOS.
- `just doc-constants-check` and `just resources-docs-check` run on macOS.
- A Linux-only syscall binding is resolved lazily (or guarded by `sys.platform`), so importing a provider module does not require a Linux libc.

## Proposed approach

Resolve the symbol on first use instead of at import — a module-level `_fallocate` cached behind a helper, returning `None`/raising a typed error on a platform that lacks it. The call sites already handle a fallback path for filesystems that do not support fallocate, so the platform-absent case can join it.

## Impact

Contributors on macOS cannot run any test or the two doc gates locally, so they either push untested or reproduce a Linux container per run. This is a developer-experience regression, not a production defect: the deployed targets are Linux.

Start by reproducing the macOS collection failure with `uv run python -m pytest`, then read `src/kdive/providers/local_libvirt/lifecycle/rootfs/rootfs_upload_fetch.py` around line 128 and the import in `tests/conftest.py`. Check the two documented `just` commands as well; done means test collection and both doc checks run on macOS while Linux CI remains unaffected.

Written by the indexing model from the issue text.