M11–M12: IRQ-as-IPC and bus drivers; expand names tree-wide

Two driver-model milestones plus a tree-wide naming pass. Suite 35/35
(QEMU) + host tests green.

M11 — IRQ-as-IPC. A ring-3 driver now sleeps until its device interrupts
it. New src/kernel/irq.zig: per-GSI endpoint bindings, comptime per-vector
trampolines, dispatch = mask GSI -> LAPIC EOI -> notifyLocked, all under one
lock region. irq_bind/irq_ack syscalls, gated by the device claim like
mmio_map. interruptDispatch no longer EOIs — each handler owns its EOI,
because a level line must be masked before it is acknowledged (irq_ack is
the unmask). Bindings are keyed on the owning task and released on exit
(a shared endpoint's siblings survive). hpetd rewritten interrupt-driven.
Tests: hpet (rewritten, reads back the I/O APIC routing) and irqfree.

M12 — bus drivers. DeviceDesc gains a parent, making the device table a
tree. dev_register (device_register) lets a process publish children below
a device it claimed; the kernel enforces resource containment (a child's
resources must nest in its parent's), so a descriptor can't fabricate a
window over kernel RAM. Descriptor copied in via copyFromUser (physmap
walk — an unmapped user pointer fails the call instead of faulting the
kernel). Per-parent child cap bounds table exhaustion. sbin/busd.zig is a
worked bus driver. Test: bus.

Naming — per docs/coding-standards.md: non-acronym abbreviations spelled
out (message, descriptor, device_service, scheduler, runtime, physical,
interpreter, ...); acronyms kept (IPC, MMIO, DMA, HCD, ...); files are
kebab-case (ipc-synchronous.zig, device-service.zig, vfs-protocol.zig, ...).
Exceptions: POSIX/C ABI names and Zig idioms (init/len/ptr) kept. Module
collisions resolved by specific naming (config -> parameters, device.zig
alias -> device_model). AML op/Op disambiguated: op = opcode, Op =
operation; per-opcode parse handlers renamed opX -> parseX.

New driver docs: drivers.md, driver-model.md (bus/class/HCD shapes + the
proposed M13–M16 ABI), coding-standards.md.

lib/system.zig

@@ -0,0 +1,52 @@
+//! Typed system_call surface for user space — thin wrappers over the raw `system_call`
+//! stubs, one per kernel call. Numbers come from `danos.SystemCall`, the single
+//! source of truth shared with the kernel dispatcher.
+
+const danos = @import("danos");
+const sc = @import("system-call.zig");
+
+/// `mmap` protection flags (matching the usual C bit values). Grants are always
+/// readable+writable today; the kernel does not yet honour finer prot.
+pub const PROT_READ: usize = danos.prot_read;
+pub const PROT_WRITE: usize = danos.prot_write;
+pub const PROT_EXEC: usize = danos.prot_exec;
+
+/// Give up the rest of this quantum.
+pub fn yield() void {
+    _ = sc.systemCall0(.yield);
+}
+
+/// Write raw bytes to the kernel log (a bring-up diagnostic; real output goes
+/// through the console/VFS later). Returns the byte count, or a wrapped -1.
+pub fn write(message: []const u8) usize {
+    return sc.systemCall2(.debug_write, @intFromPtr(message.ptr), message.len);
+}
+
+/// Block the caller for `ms` milliseconds.
+pub fn sleep(ms: usize) void {
+    _ = sc.systemCall1(.sleep, ms);
+}
+
+/// End the process. Never returns.
+pub fn exit(code: usize) noreturn {
+    _ = sc.systemCall1(.exit, code);
+    unreachable; // the kernel never returns from exit
+}
+
+/// Grant `len` bytes (rounded up to whole pages) of fresh, zeroed, writable
+/// memory and return the base virtual address. On failure returns a value in the
+/// top page (see `mmapFailed`). The user heap grows through this call.
+pub fn mmap(len: usize, prot: usize) usize {
+    return sc.systemCall2(.mmap, len, prot);
+}
+
+/// Release a range previously handed out by `mmap`.
+pub fn munmap(base: usize, len: usize) usize {
+    return sc.systemCall2(.munmap, base, len);
+}
+
+/// Whether an `mmap` return value is an error (the kernel returns a wrapped
+/// -errno, which lands in the top page — no real grant base is ever that high).
+pub inline fn mmapFailed(ret: usize) bool {
+    return ret > ~@as(usize, 0) - 4095;
+}