build: exact per-binary imports — the pre-wired default set is gone

Every binary's build.zig now names precisely the modules its source
imports (derived by scanning each artifact's sources, transitively
through same-directory files), and its zon carries only the domains
those come from — kernel stays implicit (the root shim + link script
live there). build-support's userBinary resolves each name through one
module-to-domain table (module_homes); Domains/domains()/defaultImports
and the raw recipe entry point are deleted. An undeclared @import is a
compile error (verified: injecting @import("xkeyboard-config") into
logger fails with 'no module named ... available within module
program'), and e.g. xkeyboard-config now appears in exactly two
manifests — the two keyboard drivers. Availability never bloated the
emitted binaries (Zig compiles only what a program imports); this makes
the declared interfaces honest. Production and -Dtest-case manifests
byte-identical; all build variants and standalone package builds
green.

system/services/init/build.zig

@@ -1,7 +1,7 @@
-//! init (PID 1) as a binary package (docs/build-packages-plan.md, phase 2):
-//! this file names only what is specific to init — the shared recipe and the
-//! default-import wiring live in build-support. The root build consumes the
-//! artifact for the boot image and forwards its -Dserial here.
+//! init (PID 1) as a binary package (docs/build-packages-plan.md): this file
+//! names the binary and EXACTLY the modules its source imports — the shared
+//! recipe and the module-to-domain map live in build-support. The root build
+//! consumes the artifact for the boot image and forwards its -Dserial here.
 
 const std = @import("std");
 const build_support = @import("build-support");
@@ -10,14 +10,11 @@ pub fn build(b: *std.Build) void {
     const exe = build_support.userBinary(b, .{
         .name = "init",
         .root_source_file = b.path("init.zig"),
-        .domains = build_support.domains(b),
+        .imports = &.{
+            "csv", "file-system", "ipc", "logging", "memory", "power-protocol",
+            "process", "time",
+        },
     });
-    // init speaks the power protocol (orderly shutdown, docs/power.md) and
-    // parses its boot service list from /etc/init.csv with the shared csv
-    // helpers. Which services it starts is data, not a compile-time option:
-    // the root build selects which init.csv variant is bundled (-Ddiagnose).
-    build_support.programModule(exe).addImport("power-protocol", b.dependency("protocol", .{}).module("power-protocol"));
-    build_support.programModule(exe).addImport("csv", b.dependency("csv", .{}).module("csv"));
     // init reads the same `serial` flag the kernel does: its liveness heartbeat
     // is a serial/test-build diagnostic (the QEMU harness's init tests assert
     // on it, and -Dserial images emit it), so a flashable image runs a purely