C2: migrate consumers off the runtime shim to direct concern-module imports

Every user binary and the two device-logic library modules (pci, usb) now
`@import` the concern modules directly instead of aliasing through `runtime`:

  runtime.ipc/process/time/service/input/block/display  -> @import("<module>")
  runtime.device / runtime.device_manager               -> @import("driver")
  runtime.fs                                             -> @import("file-system")
  runtime.Thread                                         -> @import("thread").Thread
  runtime.system.{write,writeRecord,klog*}              -> logging.*
  runtime.system.{sleep,timerOnce,wallClock,clock}     -> time.*
  runtime.system.{spawn*,kill,exit,yield,processes,...}-> process.*
  runtime.system.{mmap,munmap,PROT_*}                  -> memory.*
  runtime.dma.* / runtime.shared_memory.* / runtime.allocator -> memory.*

Each consumer keeps its own alias name (e.g. `const device = @import("driver")`),
so call sites are unchanged and there are no collisions with local `driver`
variables. build.zig now injects the concern modules into every user binary via
`default_imports`; pci/usb module import lists were updated to match.

The `runtime` and `system` shims remain for one more step (root.zig still uses
runtime); they are deleted in C5. Nothing but root.zig imports `runtime` now.

Verified: zig build, zig build test, and 17 QEMU cases (smoke, device-manager,
logger, fat-mount, fat-mutations, usb-storage, usb-hid, display-native,
virtio-gpu, input, thread-spawn, thread-mutex, process-kill, shared-memory,
driver-restart, acpi-ps2, pci-scan).

system/services/crash-test/crash-test.zig

@@ -7,33 +7,37 @@
 //! binary), it exits silently so it cannot derange other tests.
 
 const std = @import("std");
-const runtime = @import("runtime");
+const ipc = @import("ipc");
+const process = @import("process");
+const time = @import("time");
+const device = @import("driver");
+const logging = @import("logging");
 const device_manager_protocol = @import("device-manager-protocol");
 
-pub fn main(init: runtime.process.Init) void {
+pub fn main(init: process.Init) void {
     const argument = init.arguments.get(1) orelse return; // bare: stay silent
     const assigned = std.fmt.parseInt(u64, argument, 10) catch return;
 
     // The respawn only reaches this line because the kernel released the
     // previous instance's claim at death. A failed claim exits cleanly — the
     // manager reads "meant to stop" and the scenario fails loudly by silence.
-    if (!runtime.device.claim(assigned)) {
-        _ = runtime.system.write("crash-test: claim failed\n");
+    if (!device.claim(assigned)) {
+        _ = logging.write("crash-test: claim failed\n");
         return;
     }
 
-    var manager: ?runtime.ipc.Handle = null;
+    var manager: ?ipc.Handle = null;
     var tries: u32 = 0;
     while (manager == null and tries < 100) : (tries += 1) {
-        manager = runtime.ipc.lookup(.device_manager);
-        if (manager == null) runtime.system.sleep(20);
+        manager = ipc.lookup(.device_manager);
+        if (manager == null) time.sleepMillis(20);
     }
     const h = manager orelse return;
     const hello = device_manager_protocol.Hello{ .role = @intFromEnum(device_manager_protocol.Role.device), .device_id = assigned };
     var reply: [device_manager_protocol.message_maximum]u8 = undefined;
-    _ = runtime.ipc.call(h, std.mem.asBytes(&hello), &reply) catch return;
+    _ = ipc.call(h, std.mem.asBytes(&hello), &reply) catch return;
 
-    _ = runtime.system.write("crash-test: faulting now\n");
+    _ = logging.write("crash-test: faulting now\n");
     const poison: *volatile u32 = @ptrFromInt(0xdead0000);
     poison.* = 1; // the restart machinery's fuel: a real segmentation fault
 }