fix(system): validate system command arity

[belowzeroff]

What changes for users

.sys.timeit and .sys.env keep their existing zero- and one-argument behavior, but now reject extra arguments with a domain error. .sys.build is explicitly zero-argument and now rejects accidental arguments instead of silently ignoring them.

Why

These system commands previously accepted extra arguments without reporting misuse. The change makes their public arity enforceable while preserving valid calls and documenting the supported signatures.

Validation

• Targeted rfl/system: 41/41 passed
• Full suite: 3928/3928 passed
• Release build with -Werror: passed
• Based on fresh origin/dev (d13bde4c)

This is a focused follow-up PR and does not duplicate the .sys.gc change in PR #615.