Phase 2b: wire mkdir + unlink through the VFS to runtime.fs

The engine gained mkdir/unlink in Phase 2a; this exposes them as first-class
filesystem operations so programs can use them.

- vfs protocol: two new path-based operations, mkdir and unlink (appended, so
  existing opcodes/offsets are unchanged).
- VFS router: a forwardPath helper relays a path-based op under a mount to its
  backend; the mkdir/unlink cases forward to the mounted filesystem (the flat
  ramfs refuses them — it has no directories).
- fat server: mkdir -> engine.createDirectory, unlink -> engine.removeFile, each
  resolving the parent via a shared splitParent helper (also used by open-create).
- runtime.fs: makeDirectory(path) and remove(path).
- fat-test now exercises the whole path — mkdir /mnt/usb/TESTDIR, create + write +
  read a file inside it, then remove it — behind a new `fat-mutations` QEMU case.

Verified: zig build, zig build test, zig build check-fat-image, and a sequential
QEMU sweep — fat-mount, fat-mutations (mkdir/write/read/unlink through the mount),
vfs, vfs-client-death, log-flush, orderly-shutdown, initial-ramdisk, smoke — green.

docs/zig-self-hosting.md

@@ -251,13 +251,13 @@ Because `std.fs`/`std.Io` have no per-OS branches, finishing this in `runtime.os
 lights up the whole file tower for the compiler at once. Environment can stay an empty
 map until the kernel populates a non-empty `envp`.
 
-**Status (Phase 2a landed):** `truncate` is done end to end — `engine.truncate` frees
-the cluster chain, an O_TRUNC open flag wires it through the VFS and `runtime.fs`, and
-the boot-log flush uses it (closing the stale-tail bug). The engine also has
-`createDirectory` (mkdir) and `removeFile` (unlink), both host-tested (LFN-aware
-deletion included). Still to do: expose mkdir/unlink as VFS operations + `runtime.fs`
-methods (they are new path-based ops needing router cases); `rename`; and the richer
-`stat` (blocked on wall-clock).
+**Status (Phase 2a–2b landed):** `truncate` (O_TRUNC end to end, closing the boot-log
+stale-tail bug), `mkdir`, and `unlink` are all wired through the FAT engine, the VFS
+protocol + router, and `runtime.fs` (`makeDirectory`/`remove`) — host-tested and
+QEMU-tested (the `fat-mutations` case creates a directory, writes+reads a file in it,
+then removes it through the mount). `removeFile` is LFN-aware. Still to do: `rename`
+(engine + wiring), and then the richer `stat` — mtime/mode — which needs **wall-clock**
+(a kernel RTC read), the natural next kernel-side step.
 
 ### Phase 3 — Single-threaded, self-linked compiler bring-up