isolation M1: ring 3 + a real /sbin/init, end to end

Ring 3 works: user GDT descriptors (sysret-ready layout), TSS.rsp0,
U/S-bit user mappings (W^X preserved), an int 0x80 syscall gate with a
mutable trap frame, and a setjmp-style enter/exit path. /sbin/init is a
real freestanding Zig binary built from sbin/, shipped on the ESP,
loaded by the bootloader (BootInfo.init_base/len), validated and mapped
by an in-kernel user-ELF loader, and run at CPL 3 — syscalls: exit,
ping, write. Tests: user, user-pf (U/S isolation proof, error code
0x5), init. Suite 27/27.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

docs/syscall.md

@@ -1,5 +1,11 @@
 # System Calls
-System calls (syscalls) are the bridge between your programs and the operating system's restricted core (kernel). 
+System calls (syscalls) are the bridge between your programs and the operating system's restricted core (kernel).
+
+> **Status:** danos currently has a placeholder M1 surface behind an `int 0x80`
+> gate — `0 = exit(code)`, `1 = ping(value)`, `2 = write(ptr, len)` (see
+> `src/kernel/usermode.zig`, used by `sbin/init.zig`). It exists to prove the
+> ring transition; the microkernel set below replaces it (via `syscall`/`sysret`)
+> when processes land (M3).
 
 ## The Mechanism of a Syscall