isolation M1: ring 3 + a real /sbin/init, end to end

Ring 3 works: user GDT descriptors (sysret-ready layout), TSS.rsp0,
U/S-bit user mappings (W^X preserved), an int 0x80 syscall gate with a
mutable trap frame, and a setjmp-style enter/exit path. /sbin/init is a
real freestanding Zig binary built from sbin/, shipped on the ESP,
loaded by the bootloader (BootInfo.init_base/len), validated and mapped
by an in-kernel user-ELF loader, and run at CPL 3 — syscalls: exit,
ping, write. Tests: user, user-pf (U/S isolation proof, error code
0x5), init. Suite 27/27.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

src/kernel/arch/x86_64/tss.zig

@@ -1,9 +1,11 @@
-//! Task State Segment and its interrupt stack. In long mode the TSS's main job
-//! is the Interrupt Stack Table: an IDT gate can name an IST entry, and the CPU
-//! switches to that stack when the exception fires — no matter how broken the
-//! interrupted stack was. We use IST1 for the double-fault handler, so a fault
-//! that happens *because* the current stack is unusable still lands on solid
-//! ground instead of triple-faulting.
+//! Task State Segment and its interrupt stacks. In long mode the TSS has two
+//! jobs. First, the Interrupt Stack Table: an IDT gate can name an IST entry,
+//! and the CPU switches to that stack when the exception fires — no matter how
+//! broken the interrupted stack was. We use IST1 for the double-fault handler,
+//! so a fault that happens *because* the current stack is unusable still lands
+//! on solid ground instead of triple-faulting. Second, rsp0: the kernel stack
+//! the CPU switches to when an interrupt arrives from ring 3 (published by the
+//! user-mode entry path via `rsp0Ptr`).
 //!
 //! Each core needs **its own TSS** (its own IST stack): two cores taking a fault at
 //! once can't share one fault stack. So the TSS and its IST stack are per-core,
@@ -50,6 +52,16 @@ var ap_ist_top = [_]usize{0} ** max_cpus; // per-AP IST stack top (0 = BSP / not
 /// Loads the task register with the TSS selector. Defined in isr.s.
 extern fn load_tr(selector: u16) callconv(.c) void;
 
+/// Address of core `cpu`'s rsp0 slot — the kernel stack the CPU switches to on a
+/// ring-3 -> ring-0 interrupt. Computed as base + 4 (rsp0's architectural offset,
+/// which is why the pointer is only 4-aligned) rather than `&t.rsp0`, which on a
+/// packed struct would be an unaligned bit-pointer type. The ring-3 entry path
+/// (enter_user in isr.s) writes the current kernel stack pointer through this
+/// before dropping to user mode.
+pub fn rsp0Ptr(cpu: usize) *align(4) u64 {
+    return @ptrFromInt(@intFromPtr(&tss_table[cpu]) + 4);
+}
+
 /// Record the top of the IST stack the kernel allocated for AP `cpu`. Called on the
 /// BSP before waking that core; read by the core's own `setupThisCpu`.
 pub fn setApIstStack(cpu: usize, top: usize) void {