kernel: device_transfer — you may give away what you hold

The mechanism behind delegation, which device-manager.md named as the step
after hello: the device manager claims what discovery seeded and hands each
device to the driver it matched, so assignment stops being
first-come-first-served.

It is a MOVE, not a copy. A claim is exclusive (driver-model.md, invariant
1), so the giver stops holding the device the instant the receiver starts.
That is why this is a new syscall rather than the M13 capability path, where
a passed handle is shared refcounted — exclusivity cannot be expressed that
way.

The kernel's whole rule is that you may give away what you hold. It has no
notion of which task is the device manager and deliberately gains none: a
binary name inside the kernel is not something that cannot safely live in
user space. A recipient that does not exist is refused, because a device
moved to nobody would be unreachable for the rest of the boot — nothing
un-holds a device but task death.

Three errnos, each naming its own rule: ENODEV no such device, EPERM you do
not hold it, ESRCH no such recipient.

Nothing uses it yet. The five claimants move across one at a time in D4-D5,
so the suite stays green throughout and a regression names the driver that
caused it.

Ten assertions, verified to discriminate: removing the ownership check flips
four of them, including the giveaway that an illegal transfer then blocks
the legitimate claim behind it.

Suite 116 -> 117.

library/device/driver/driver.zig

@@ -46,6 +46,25 @@ pub fn enumerate(buffer: []DeviceDescriptor) usize {
     return sc.systemCall2(.device_enumerate, @intFromPtr(buffer.ptr), buffer.len);
 }
 
+/// Why a `transfer` failed. `NotHeld` is the interesting one — it means the caller tried
+/// to give away a device it does not have, which is the whole rule.
+pub const TransferError = error{ NoSuchDevice, NotHeld, NoSuchTask, Refused };
+
+/// Give device `id` to task `to`. **A move, not a copy** — a claim is exclusive, so the
+/// caller stops holding it. This is how the device manager hands a driver the device it
+/// matched, replacing first-come-first-served claiming with policy
+/// (docs/os-development/device-authority.md).
+pub fn transfer(id: u64, to: u32) TransferError!void {
+    const r = sc.systemCall2(.device_transfer, id, to);
+    if (!failed(r)) return;
+    return switch (errnoOf(r)) {
+        abi.ENODEV => error.NoSuchDevice,
+        abi.EPERM => error.NotHeld,
+        abi.ESRCH => error.NoSuchTask,
+        else => error.Refused,
+    };
+}
+
 /// Why a `claim` failed. Worth distinguishing: `AlreadyClaimed` means back off and
 /// let the owner have it, `NoSuchDevice` means this id is stale and the caller should
 /// re-enumerate, and `NotConfined` means the machine could not place the device under