logger: per-process log files under /var/log/<boot-stamp>/

The logger service drains the tagged ring every 250 ms and demultiplexes
it into one file per process on the flash volume:

    /mnt/usb/var/log/2026-07-21T150434Z/system/services/fat.log
    [     0.214] mounted FAT (fat32, 128992 clusters, partition lba 0)

The boot stamp is the wall-clock anchor from klog_status (FAT-safe, no
colons); the kernel's records go to kernel.log; each line carries the
record's monotonic timestamp and level. Storage is best-effort and
late — the ring buffers a whole boot until the mount appears, then the
first drain writes the backlog, storage-stack records included. Lost
records surface as '-- N records lost --' from sequence gaps. Files
close (= fat's device cache flush) after a 2 s quiet period, bounding
data-at-risk without per-record flush thrash. The logger announces
itself once — a periodic status line would feed the stream it drains.

init spawns the logger last, so the reverse-order shutdown stops it
first and its final drain runs over a live storage chain; log-flush and
init's own DANOS.LOG shutdown flush retire (superseded). runtime.fs
makePath treats components at or above a mount point as router names —
create is best-effort per prefix, the final verdict is exists(path).

test/qemu_test.py

@@ -553,17 +553,18 @@ CASES = [
                r"power: entering S5",
      "fail":   r"power: S5 write did not take|DANOS-TEST-RESULT: FAIL"},
     # M8: the boot log is persisted to the USB FAT volume. Reuses the orderly-
-    # shutdown build (full tree + power button): init spawns log-flush at boot,
-    # which copies the kernel log to /mnt/usb/DANOS.LOG once /mnt/usb is mounted
-    # (first marker); then the power button drives init's own pre-teardown flush
-    # (second marker), proving both triggers write the file while storage is up.
-    {"name": "log-flush",
+    # shutdown build (full tree + power button): the logger service announces its
+    # per-boot directory once storage mounts (first marker), then the power
+    # button drives the orderly stop — the logger, stopped first, final-drains
+    # and reports the flush (second marker) before S5.
+    {"name": "logger",
      "build_case": "orderly-shutdown",
      "smp":    4,
      "timeout": 150,
      "qmp_after": {"delay": 8, "command": "system_powerdown"},
-     "expect": r"log-flush: wrote \d+ bytes to /mnt/usb/DANOS\.LOG[\s\S]*"
-               r"init: flushed log to /mnt/usb/DANOS\.LOG[\s\S]*"
+     "expect": r"logger: logging to /mnt/usb/var/log/\d{4}-\d{2}-\d{2}T\d{6}Z[\s\S]*"
+               r"init: shutting down[\s\S]*"
+               r"logger: flushed through sequence \d+[\s\S]*"
                r"power: entering S5",
      "fail":   r"DANOS-TEST-RESULT: FAIL"},
     # M20.2: the acpi service evaluates _CRS/_STA in ring 3 and registers +