Phase 1a: add the native runtime.fs, retire the posix shim

The first step of the Zig self-hosting roadmap (docs/zig-self-hosting.md): give
danos programs a danos-native file API and remove the premature POSIX compatibility
shim. This also resolves the earlier misplacement of a full-write helper into the
compat layer — that behaviour now lives natively in runtime.fs.File.writeAll.

- library/runtime/fs.zig: the danos-native file client over the VFS (open/read/
  write/writeAll/seekTo/attributes/close, directory listing, mount). Handles are
  *values* — a File/Directory owns its VFS node id and byte offset — so there is no
  per-process fd table or descriptor limit, unlike the POSIX fd model the shim
  emulated. This is where the operations that later become std.os.danos are staged.
- Retire library/posix/ (unistd, stdio): only five call sites used it, all file
  operations, all migrated to runtime.fs — fat (mount), the vfs-test and fat-test
  clients, and init/log-flush (the boot-log flush). stdio was already dead.
- build.zig: drop the posix module, its addUserBinary parameter, the per-binary
  import, and the ~26 call-site arguments.
- Docs: the VFS protocol's client is now runtime.fs; the docs index and
  coding-standards note posix is retired and the foreign-ABI naming exception now
  applies to the future std.os.danos seam; the process-lifecycle note points the
  future musl layer at that same seam rather than the deleted directory.

Deferred by design (see the roadmap): the C-ABI runtime.os errno seam is built at
fork time (its shape must match std/os/danos.zig); truncate/mkdir/rename are
Phase 2; stdio-byte fds and cwd are later slices.

Verified: zig build, zig build test, zig build check-fat-image, and a sequential
QEMU sweep — vfs, vfs-client-death (the park/hold-handle path), fat-mount, log-flush,
orderly-shutdown, initial-ramdisk (log-flush silent in the bare sweep), smoke, init,
usb-storage, device-manager — all green.

system/services/init/init.zig

@@ -19,7 +19,6 @@
 
 const std = @import("std");
 const runtime = @import("runtime");
-const unistd = @import("posix").unistd;
 const power = runtime.power_protocol;
 
 /// Where the kernel boot log is persisted on the USB FAT volume — an 8.3 name at
@@ -134,15 +133,14 @@ fn subscribePower() void {
 /// USB volume is not mounted, the open fails and it does nothing. Must run while
 /// the storage services are still alive (see shutDown).
 fn flushKernelLog() void {
-    const fd = unistd.open(log_path, unistd.O_CREAT);
-    if (fd < 0) return; // no USB volume mounted — nothing to persist to
-    defer unistd.close(fd);
+    var file = runtime.fs.open(log_path, .{ .create = true }) orelse return; // no USB volume mounted
+    defer file.close();
     var chunk: [4096]u8 = undefined;
     var offset: usize = 0;
     while (true) {
         const got = runtime.system.klogRead(offset, &chunk);
         if (got == 0) break; // reached the end of the accumulated log
-        if (unistd.writeAll(fd, chunk[0..got]) < 0) break; // storage went away
+        if (file.writeAll(chunk[0..got]) == null) break; // storage went away
         offset += got;
     }
     var line: [96]u8 = undefined;