Phase 1a: add the native runtime.fs, retire the posix shim

The first step of the Zig self-hosting roadmap (docs/zig-self-hosting.md): give
danos programs a danos-native file API and remove the premature POSIX compatibility
shim. This also resolves the earlier misplacement of a full-write helper into the
compat layer — that behaviour now lives natively in runtime.fs.File.writeAll.

- library/runtime/fs.zig: the danos-native file client over the VFS (open/read/
  write/writeAll/seekTo/attributes/close, directory listing, mount). Handles are
  *values* — a File/Directory owns its VFS node id and byte offset — so there is no
  per-process fd table or descriptor limit, unlike the POSIX fd model the shim
  emulated. This is where the operations that later become std.os.danos are staged.
- Retire library/posix/ (unistd, stdio): only five call sites used it, all file
  operations, all migrated to runtime.fs — fat (mount), the vfs-test and fat-test
  clients, and init/log-flush (the boot-log flush). stdio was already dead.
- build.zig: drop the posix module, its addUserBinary parameter, the per-binary
  import, and the ~26 call-site arguments.
- Docs: the VFS protocol's client is now runtime.fs; the docs index and
  coding-standards note posix is retired and the foreign-ABI naming exception now
  applies to the future std.os.danos seam; the process-lifecycle note points the
  future musl layer at that same seam rather than the deleted directory.

Deferred by design (see the roadmap): the C-ABI runtime.os errno seam is built at
fork time (its shape must match std/os/danos.zig); truncate/mkdir/rename are
Phase 2; stdio-byte fds and cwd are later slices.

Verified: zig build, zig build test, zig build check-fat-image, and a sequential
QEMU sweep — vfs, vfs-client-death (the park/hold-handle path), fat-mount, log-flush,
orderly-shutdown, initial-ramdisk (log-flush silent in the bare sweep), smoke, init,
usb-storage, device-manager — all green.

system/services/vfs/protocol.zig

@@ -4,12 +4,11 @@
 //! header followed by an inline payload (read bytes, or a FileStatus). Everything fits
 //! in one IPC message (<= ipc MESSAGE_MAXIMUM = 256 bytes).
 //!
-//! This is a danos-native contract, so it uses danos names throughout — the POSIX
-//! spellings (`stat`, `O_CREAT`, ...) live only in the POSIX layer
-//! (library/posix/unistd.zig), which translates to these.
+//! This is a danos-native contract, so it uses danos names throughout. The client
+//! side is `runtime.fs` (library/runtime/fs.zig), which programs use directly.
 //!
 //! This is user-space only — the kernel knows nothing of files or paths; it only moves the bytes.
-//! Shared by library/posix/unistd.zig (client) and system/services/vfs/vfs.zig (server).
+//! Shared by library/runtime/fs.zig (client) and system/services/vfs/vfs.zig (server).
 
 pub const Operation = enum(u32) {
     open, // open(path) -> node id

system/services/vfs/vfs-test.zig

@@ -1,26 +1,26 @@
 //! /system/services/vfs/vfs-test — a client that proves the VFS round trip end to end: open a
-//! file through the `runtime` file API, write to it, seek back, read it, and compare.
+//! file through the `runtime.fs` file API, write to it, seek back, read it, and compare.
 //! On success it heartbeats "vfstest: ok" so the kernel test can observe it;
 //! on failure it reports what went wrong. Shipped in the initial_ramdisk alongside vfs.
 
 const std = @import("std");
 const runtime = @import("runtime");
+const fs = runtime.fs;
 
 pub fn main(init: runtime.process.Init) void {
-    const u = @import("posix").unistd;
     const payload = "hello-vfs";
 
     // The "park" role (the vfs-client-death test): open a file, then hold the
     // handle forever without closing — the kill and the VFS's release-on-death
     // are the point.
     if (init.arguments.count > 1) {
-        var fd: i32 = -1;
+        var parked: ?fs.File = null;
         var tries: u32 = 0;
-        while (fd < 0 and tries < 200) : (tries += 1) {
-            fd = u.open("parked", u.O_CREAT);
-            if (fd < 0) runtime.system.sleep(20);
+        while (parked == null and tries < 200) : (tries += 1) {
+            parked = fs.open("parked", .{ .create = true });
+            if (parked == null) runtime.system.sleep(20);
         }
-        if (fd < 0) {
+        if (parked == null) {
             _ = runtime.system.write("vfstest: park open failed\n");
             return;
         }
@@ -31,28 +31,28 @@ pub fn main(init: runtime.process.Init) void {
     }
 
     // The VFS server may not have registered yet — retry open until it's up.
-    var fd: i32 = -1;
+    var opened: ?fs.File = null;
     var tries: u32 = 0;
-    while (fd < 0 and tries < 200) : (tries += 1) {
-        fd = u.open("greeting", u.O_CREAT);
-        if (fd < 0) runtime.system.sleep(20);
+    while (opened == null and tries < 200) : (tries += 1) {
+        opened = fs.open("greeting", .{ .create = true });
+        if (opened == null) runtime.system.sleep(20);
     }
-    if (fd < 0) {
+    var greeting = opened orelse {
         _ = runtime.system.write("vfstest: open failed\n");
         return;
-    }
+    };
 
-    if (u.write(fd, payload) != @as(isize, payload.len)) {
+    if ((greeting.write(payload) orelse 0) != payload.len) {
         _ = runtime.system.write("vfstest: write failed\n");
         return;
     }
-    _ = u.lseek(fd, 0, u.SEEK_SET);
+    greeting.seekTo(0);
 
     var buffer: [32]u8 = undefined;
-    const n = u.read(fd, &buffer);
-    u.close(fd);
+    const n = greeting.read(&buffer) orelse 0;
+    greeting.close();
 
-    if (n == @as(isize, payload.len) and std.mem.eql(u8, buffer[0..@intCast(n)], payload)) {
+    if (n == payload.len and std.mem.eql(u8, buffer[0..n], payload)) {
         while (true) {
             _ = runtime.system.write("vfstest: ok\n");
             runtime.system.sleep(1000);