iommu: assert directly that a confinement moves with its device

reassign was added at D4 to fix a regression and has been proven only
indirectly since — three IOMMU+USB cases going green. That covered the
visible symptom (a driver's DMA rings unbound) and neither of the latent
ones: the confinement still naming the giver, so the giver's death would
tear down a domain a live driver was using, and the receiver's death would
leave one behind. Those are now asserted.

confinementOwner exposes the record's owner so the suite can see it. The
sequence is the delegation in miniature: unconfined, confine as this task,
reassign to another, confirm the new holder owns it and the old one does
not, then kill the new holder and confirm the domain goes with it.

Two attempts at this test could not have failed. The first found no PCI
function to confine — pciAddressOf needs a pci_device entry and this case
runs no pci-bus — so every assertion skipped silently while the case stayed
green. It now synthesizes a function the way pci-bus does, a 4 KiB config
window inside the bridge's ECAM, and asserts that precondition explicitly so
a skip is a failure.

Verified to discriminate: making reassign a no-op flips three assertions,
including the domain surviving its holder's death.

Suite 118/118.

system/kernel/iommu.zig

@@ -234,6 +234,17 @@ pub fn reassign(device_id: u64, owner: u32) void {
     record.owner = owner;
 }
 
+/// The task a device's confinement is recorded against, or null if it has none. The
+/// confinement's owner decides whose death tears the domain down, so a delegation that
+/// moved the device but not this record would leave a live driver's domain destroyed by
+/// its manager's exit — which is why `reassign` exists and why the suite asserts it.
+pub fn confinementOwner(device_id: u64) ?u32 {
+    if (!active) return null;
+    if (device_id >= confined.len) return null;
+    const record = confined[@intCast(device_id)];
+    return if (record.active) record.owner else null;
+}
+
 pub fn releaseAllOwnedBy(owner: u32) void {
     if (!active) return;
     for (confined) |*c| {