init: /protocol replaces the ServiceId registry

A protocol is reached by name now, not by a compile-time integer. Init is
PID 1 and already knows which binary it started, so init serves /protocol
as a vfs backend: bind claims a contract with the provider's endpoint
attached, open answers with that endpoint as the reply's capability, and
readdir lists what is bound with the task and binary behind it. The kernel
reserves the prefix — nothing may mount over it, under it, or unmount it —
and ServiceId, ipc_register and ipc_lookup are gone, their syscall numbers
left vacant.

A bind is authorized by who the caller *is*: the kernel-stamped binary
together with the supervising task's identity, matched against
/system/configuration/protocol.csv. Identity, not spelling — spawn is
ungated, so an attacker can run any bundled binary, and a name-only rule
would have let it launder grants through an init of its own making. A name
a live process holds is refused to everyone else; a dead one's is released.

Three review rounds against a hostile ring-3 process found what 108 green
tests could not, because the suite contains no attacker. Publishing init's
supervision endpoint as the registry put PID 1's mailbox in every process's
hands, where two forged bytes reached the shutdown path: privileged traffic
is now believed only from the task that holds the contract it speaks for.
A capability arriving on a request outlived every path that ignored it,
one handle per call until the table was full — in init, and in the harness
ten services share — so the arriving capability is owned by the turn and
released unless a handler says otherwise. And the kernel let anyone holding
an endpoint handle aim signals, timers, exit notices and interrupts at it:
binding now requires having created it.

Suite 108/108. The new protocol-registry case asserts eleven properties,
each one an attack that must fail.

system/kernel/vfs.zig

@@ -168,6 +168,11 @@ fn installMount(prefix: []const u8, kind: MountKind, backend: ?*ipc.Endpoint, re
     var slot: ?*Mount = null;
     for (&mounts) |*m| {
         if (m.used and std.mem.eql(u8, m.prefixSlice(), prefix)) {
+            // ...except the protocol namespace. Remount-replace is how a
+            // restarted FAT retakes /volumes/usb; letting it retake /protocol
+            // would hand the whole naming layer to whoever asked second.
+            // First mount wins, and init (PID 1) is always first.
+            if (std.mem.eql(u8, prefix, protocol_root)) return;
             if (m.backend) |old| ipc.dropRef(old);
             slot = m;
             break;
@@ -346,6 +351,30 @@ fn isInitrdCarveOut(prefix: []const u8) bool {
     return false;
 }
 
+/// The protocol namespace's root — a reserved prefix, like the initrd trees.
+/// Init (PID 1) mounts the registry here once at boot and the prefix then
+/// refuses everything: a second mount at it, any mount *under* it (which would
+/// shadow one contract), and its unmount. That is the whole kernel-side residue
+/// of the naming layer — the registrar authority itself never leaves init
+/// (docs/os-development/protocol-namespace.md).
+const protocol_root = "/protocol";
+
+fn protocolBound() bool {
+    for (&mounts) |*m| {
+        if (m.used and std.mem.eql(u8, m.prefixSlice(), protocol_root)) return true;
+    }
+    return false;
+}
+
+/// Whether mounting at `prefix` would touch the protocol namespace. Exactly
+/// `/protocol` is allowed once — while nothing holds it; anything under it,
+/// ever, is refused.
+fn refusesProtocolMount(prefix: []const u8) bool {
+    const relative = underMount(prefix, protocol_root) orelse return false;
+    if (relative.len != 1) return true; // strictly under /protocol: never
+    return protocolBound(); // /protocol itself: first mount wins
+}
+
 /// Mount `backend` at `prefix` with an optional backend-side `rewrite` prefix.
 /// The endpoint reference is taken by the caller (process.zig bumps it); refuses
 /// shadowing or replacing the initrd trees (/system, /test) — except the two
@@ -353,6 +382,7 @@ fn isInitrdCarveOut(prefix: []const u8) bool {
 pub fn mountBackend(prefix: []const u8, backend: *ipc.Endpoint, rewrite: []const u8) bool {
     if (!isAbsolute(prefix) or prefix.len < 2 or prefix.len > maximum_prefix) return false;
     if (rewrite.len > maximum_rewrite) return false;
+    if (refusesProtocolMount(prefix)) return false; // the registry's prefix is claimed once
     for (&mounts) |*m| { // the initrd trees are not shadowable (carve-outs aside)
         if (m.used and m.kind == .kernel_initrd and underMount(prefix, m.prefixSlice()) != null) {
             if (!isInitrdCarveOut(prefix)) return false;
@@ -363,6 +393,9 @@ pub fn mountBackend(prefix: []const u8, backend: *ipc.Endpoint, rewrite: []const
 }
 
 pub fn unmount(prefix: []const u8) bool {
+    // Unmounting /protocol would delete the naming layer for everyone; nobody
+    // may, init included. The mount lasts the boot.
+    if (std.mem.eql(u8, prefix, protocol_root)) return false;
     for (&mounts) |*m| {
         if (m.used and m.kind == .backend and std.mem.eql(u8, m.prefixSlice(), prefix)) {
             if (m.backend) |endpoint| ipc.dropRef(endpoint);