Phase 1a: add the native runtime.fs, retire the posix shim

The first step of the Zig self-hosting roadmap (docs/zig-self-hosting.md): give
danos programs a danos-native file API and remove the premature POSIX compatibility
shim. This also resolves the earlier misplacement of a full-write helper into the
compat layer — that behaviour now lives natively in runtime.fs.File.writeAll.

- library/runtime/fs.zig: the danos-native file client over the VFS (open/read/
  write/writeAll/seekTo/attributes/close, directory listing, mount). Handles are
  *values* — a File/Directory owns its VFS node id and byte offset — so there is no
  per-process fd table or descriptor limit, unlike the POSIX fd model the shim
  emulated. This is where the operations that later become std.os.danos are staged.
- Retire library/posix/ (unistd, stdio): only five call sites used it, all file
  operations, all migrated to runtime.fs — fat (mount), the vfs-test and fat-test
  clients, and init/log-flush (the boot-log flush). stdio was already dead.
- build.zig: drop the posix module, its addUserBinary parameter, the per-binary
  import, and the ~26 call-site arguments.
- Docs: the VFS protocol's client is now runtime.fs; the docs index and
  coding-standards note posix is retired and the foreign-ABI naming exception now
  applies to the future std.os.danos seam; the process-lifecycle note points the
  future musl layer at that same seam rather than the deleted directory.

Deferred by design (see the roadmap): the C-ABI runtime.os errno seam is built at
fork time (its shape must match std/os/danos.zig); truncate/mkdir/rename are
Phase 2; stdio-byte fds and cwd are later slices.

Verified: zig build, zig build test, zig build check-fat-image, and a sequential
QEMU sweep — vfs, vfs-client-death (the park/hold-handle path), fat-mount, log-flush,
orderly-shutdown, initial-ramdisk (log-flush silent in the bare sweep), smoke, init,
usb-storage, device-manager — all green.

system/services/log-flush/log-flush.zig

@@ -16,19 +16,19 @@
 
 const std = @import("std");
 const runtime = @import("runtime");
-const unistd = @import("posix").unistd;
+const fs = runtime.fs;
 
 const log_path = "/mnt/usb/DANOS.LOG";
 
-/// Copy the whole kernel log to the open fd, looping klog_read -> write until the
-/// log is exhausted. Returns the number of bytes written.
-fn drainKernelLog(fd: i32) usize {
+/// Copy the whole kernel log to the open file, looping klog_read -> write until
+/// the log is exhausted. Returns the number of bytes written.
+fn drainKernelLog(file: *fs.File) usize {
     var chunk: [4096]u8 = undefined;
     var offset: usize = 0;
     while (true) {
         const got = runtime.system.klogRead(offset, &chunk);
         if (got == 0) break; // reached the end of the accumulated log
-        if (unistd.writeAll(fd, chunk[0..got]) < 0) break; // storage went away
+        if (file.writeAll(chunk[0..got]) == null) break; // storage went away
         offset += got;
     }
     return offset;
@@ -38,19 +38,22 @@ pub fn main() void {
     // Wait for the fat server to mount /mnt/usb (it must bring up the whole USB
     // storage chain first, so it races us at boot). Bounded: if the mount never
     // appears — no volume, or the no-VFS ramdisk sweep — give up silently.
-    var dir: i32 = -1;
+    var ready = false;
     var tries: u32 = 0;
-    while (dir < 0 and tries < 1400) : (tries += 1) {
-        dir = unistd.opendir("/mnt/usb");
-        if (dir < 0) runtime.system.sleep(50);
+    while (tries < 1400) : (tries += 1) {
+        if (fs.openDirectory("/mnt/usb")) |directory| {
+            var dir = directory;
+            dir.close();
+            ready = true;
+            break;
+        }
+        runtime.system.sleep(50);
     }
-    if (dir < 0) return; // /mnt/usb never became available — nothing to persist to
-    unistd.closedir(dir);
+    if (!ready) return; // /mnt/usb never became available — nothing to persist to
 
-    const fd = unistd.open(log_path, unistd.O_CREAT);
-    if (fd < 0) return; // could not create the file — exit quietly
-    const written = drainKernelLog(fd);
-    unistd.close(fd);
+    var file = fs.open(log_path, .{ .create = true }) orelse return; // could not create the file
+    const written = drainKernelLog(&file);
+    file.close();
 
     var line: [96]u8 = undefined;
     _ = runtime.system.write(std.fmt.bufPrint(&line, "log-flush: wrote {d} bytes to {s}\n", .{ written, log_path }) catch return);