M11–M12: IRQ-as-IPC and bus drivers; expand names tree-wide

Two driver-model milestones plus a tree-wide naming pass. Suite 35/35
(QEMU) + host tests green.

M11 — IRQ-as-IPC. A ring-3 driver now sleeps until its device interrupts
it. New src/kernel/irq.zig: per-GSI endpoint bindings, comptime per-vector
trampolines, dispatch = mask GSI -> LAPIC EOI -> notifyLocked, all under one
lock region. irq_bind/irq_ack syscalls, gated by the device claim like
mmio_map. interruptDispatch no longer EOIs — each handler owns its EOI,
because a level line must be masked before it is acknowledged (irq_ack is
the unmask). Bindings are keyed on the owning task and released on exit
(a shared endpoint's siblings survive). hpetd rewritten interrupt-driven.
Tests: hpet (rewritten, reads back the I/O APIC routing) and irqfree.

M12 — bus drivers. DeviceDesc gains a parent, making the device table a
tree. dev_register (device_register) lets a process publish children below
a device it claimed; the kernel enforces resource containment (a child's
resources must nest in its parent's), so a descriptor can't fabricate a
window over kernel RAM. Descriptor copied in via copyFromUser (physmap
walk — an unmapped user pointer fails the call instead of faulting the
kernel). Per-parent child cap bounds table exhaustion. sbin/busd.zig is a
worked bus driver. Test: bus.

Naming — per docs/coding-standards.md: non-acronym abbreviations spelled
out (message, descriptor, device_service, scheduler, runtime, physical,
interpreter, ...); acronyms kept (IPC, MMIO, DMA, HCD, ...); files are
kebab-case (ipc-synchronous.zig, device-service.zig, vfs-protocol.zig, ...).
Exceptions: POSIX/C ABI names and Zig idioms (init/len/ptr) kept. Module
collisions resolved by specific naming (config -> parameters, device.zig
alias -> device_model). AML op/Op disambiguated: op = opcode, Op =
operation; per-opcode parse handlers renamed opX -> parseX.

New driver docs: drivers.md, driver-model.md (bus/class/HCD shapes + the
proposed M13–M16 ABI), coding-standards.md.

docs/device-interrupts.md

@@ -89,7 +89,6 @@ if (state.vector < 32) {
     on_fault(state);              // exception: report and halt (never returns)
 } else if (handlers[state.vector]) |handler| {
     handler();                    // device: run the registered handler
-    apic.eoi();                   // ...acknowledge the LAPIC
 }
 // else: spurious/unhandled — deliberately no EOI
 ```
@@ -100,10 +99,23 @@ Two things make device interrupts *return* where exceptions don't:
    flows back to `isr_common`, which restores every register it saved and executes
    `iretq` — resuming the interrupted instruction exactly. (This is why the stub
    saves *all* the general registers.)
-2. **End-of-interrupt.** After handling, we write the LAPIC's EOI register. Miss
+2. **End-of-interrupt.** Somewhere in there we write the LAPIC's EOI register. Miss
    this and the LAPIC thinks we're still busy and never delivers the next
    interrupt. It's the single most common "my timer fired once and stopped" bug.
 
+**Each handler issues its own EOI**, rather than the dispatcher doing it around the
+call. That looks like a needless devolution while the timer is the only device, and
+`apic.timerTick` indeed does nothing but `eoi()` before bumping its counter (early,
+because the tick hook is the scheduler, which may switch tasks and not return
+promptly — the LAPIC mustn't wait on it).
+
+It stops looking needless with the second device. A *routed* interrupt — one arriving
+through the I/O APIC from a real device line — must be **masked before it is
+acknowledged**, because a level-triggered line is still asserted at EOI time and would
+redeliver instantly, forever. Only the handler knows which discipline its source
+needs, so only the handler can sequence it. See [drivers.md](drivers.md), where the
+device is quieted by a driver in ring 3, long after the ISR has returned.
+
 A device handler is a plain `fn () void` — a timer or keyboard handler doesn't need
 the interrupted registers. (Note: the stubs don't save the SSE/vector registers, so
 a handler must not use them; ours don't.)
@@ -131,14 +143,23 @@ If the APIC weren't enabled, or `sti` were missing, or EOI were forgotten, the
 count would stay put and the test would fail. That it advances — while the CPU was
 spinning in unrelated code — is the whole mechanism working end to end.
 
+## Since (done elsewhere)
+
+- **Preemption**: the timer handler is where the scheduler decides to switch — the
+  reason a *returning* interrupt matters. See [scheduling.md](scheduling.md).
+- **`sleep()` / timeouts** built on the calibrated clock.
+- **The I/O APIC, routed**: external device lines now reach a vector, and the
+  interrupt is delivered onward to a *user-space* driver as an IPC message. See
+  [drivers.md](drivers.md).
+- **Uncacheable MMIO**: device grants are mapped `PCD|PWT` (strong-uncacheable) for
+  user drivers — see [paging.md](paging.md).
+
 ## What's next (not done here)
 
-- **The keyboard**: bring up the IO-APIC, route its IRQ to a vector, and read
-  scancodes from the PS/2 controller — the first *input* device.
-- **`sleep()` / timeouts** built on the calibrated clock (the monotonic
-  `uptimeMs()` is in place).
-- **Uncacheable MMIO**: the LAPIC page is currently mapped writeback-cacheable like
-  the rest of the identity map. QEMU tolerates it, but real hardware wants MMIO
-  marked uncacheable (via the page's cache bits or an MTRR).
-- **Preemption**: once there are tasks, the timer handler is where the scheduler
-  decides to switch — the reason a *returning* interrupt matters.
+- **The keyboard**: the PS/2 controller is port-mapped (`0x60`/`0x64`), and ring 3
+  has no port I/O yet, so the first *input* device is blocked on either an I/O
+  permission bitmap or `io_in`/`io_out` syscalls ([drivers.md](drivers.md)).
+- **MSI/MSI-X**: per-device vectors, edge-triggered and unshared, which retire the
+  I/O APIC's mask/ack cycle and its 24-GSI ceiling.
+- **The LAPIC's own page** is still mapped writeback-cacheable like the rest of the
+  identity map. QEMU tolerates it; real hardware wants it uncacheable.