M11–M12: IRQ-as-IPC and bus drivers; expand names tree-wide

Two driver-model milestones plus a tree-wide naming pass. Suite 35/35
(QEMU) + host tests green.

M11 — IRQ-as-IPC. A ring-3 driver now sleeps until its device interrupts
it. New src/kernel/irq.zig: per-GSI endpoint bindings, comptime per-vector
trampolines, dispatch = mask GSI -> LAPIC EOI -> notifyLocked, all under one
lock region. irq_bind/irq_ack syscalls, gated by the device claim like
mmio_map. interruptDispatch no longer EOIs — each handler owns its EOI,
because a level line must be masked before it is acknowledged (irq_ack is
the unmask). Bindings are keyed on the owning task and released on exit
(a shared endpoint's siblings survive). hpetd rewritten interrupt-driven.
Tests: hpet (rewritten, reads back the I/O APIC routing) and irqfree.

M12 — bus drivers. DeviceDesc gains a parent, making the device table a
tree. dev_register (device_register) lets a process publish children below
a device it claimed; the kernel enforces resource containment (a child's
resources must nest in its parent's), so a descriptor can't fabricate a
window over kernel RAM. Descriptor copied in via copyFromUser (physmap
walk — an unmapped user pointer fails the call instead of faulting the
kernel). Per-parent child cap bounds table exhaustion. sbin/busd.zig is a
worked bus driver. Test: bus.

Naming — per docs/coding-standards.md: non-acronym abbreviations spelled
out (message, descriptor, device_service, scheduler, runtime, physical,
interpreter, ...); acronyms kept (IPC, MMIO, DMA, HCD, ...); files are
kebab-case (ipc-synchronous.zig, device-service.zig, vfs-protocol.zig, ...).
Exceptions: POSIX/C ABI names and Zig idioms (init/len/ptr) kept. Module
collisions resolved by specific naming (config -> parameters, device.zig
alias -> device_model). AML op/Op disambiguated: op = opcode, Op =
operation; per-opcode parse handlers renamed opX -> parseX.

New driver docs: drivers.md, driver-model.md (bus/class/HCD shapes + the
proposed M13–M16 ABI), coding-standards.md.

sbin/init.zig

@@ -2,7 +2,7 @@
 //! freestanding binary (see build.zig), shipped on the boot volume at sbin/init,
 //! loaded by the bootloader, and started in ring 3 as a scheduled process by the
 //! kernel (src/kernel/process.zig). It links against the shared user runtime
-//! library `rt` and talks to the kernel only through `rt`'s syscall wrappers.
+//! library `runtime` and talks to the kernel only through `runtime`'s system_call wrappers.
 //!
 //! Today it proves the C-convention heap works, then settles into a heartbeat:
 //! it prints a line and sleeps, forever — enough to show the system reaches user
@@ -10,7 +10,7 @@
 //! idle loop. It grows into the real init (service supervision) once there are
 //! other user programs to supervise.
 
-const rt = @import("rt");
+const runtime = @import("runtime");
 
 pub fn main() void {
     // Prove the heap end to end: allocate through the runtime allocator (which
@@ -19,21 +19,21 @@ pub fn main() void {
     // free it. A fault here would kill init before it heartbeats — so the init
     // test doubles as the heap regression test. (C code links the same heap via
     // the extern malloc/free symbols; Zig code uses this allocator.)
-    const gpa = rt.allocator();
-    if (gpa.alloc(u8, 64)) |buf| {
-        const msg = "init: heap ok\n";
-        @memcpy(buf[0..msg.len], msg);
-        _ = rt.sys.write(buf[0..msg.len]);
-        gpa.free(buf);
+    const gpa = runtime.allocator();
+    if (gpa.alloc(u8, 64)) |buffer| {
+        const message = "init: heap ok\n";
+        @memcpy(buffer[0..message.len], message);
+        _ = runtime.system.write(buffer[0..message.len]);
+        gpa.free(buffer);
     } else |_| {}
 
     while (true) {
-        _ = rt.sys.write("init: heartbeat\n");
-        rt.sys.sleep(1000);
+        _ = runtime.system.write("init: heartbeat\n");
+        runtime.system.sleep(1000);
     }
 }
 
-pub const panic = rt.panic;
+pub const panic = runtime.panic;
 comptime {
-    _ = &rt.start._start; // pull the runtime entry shim into the image
+    _ = &runtime.start._start; // pull the runtime entry shim into the image
 }