avoid all malloc/free in timer creation/destruction

avoid all malloc/free in timer creation/destruction

instead of allocating a userspace structure for signal-based timers,
simply use the kernel timer id. we use the fact that thread pointers
will always be zero in the low bit (actually more) to encode integer
timerid values as pointers.

also, this change ensures that the timer_destroy syscall has completed
before the library timer_destroy function returns, in case it matters.