isolation M1: ring 3 + a real /sbin/init, end to end

Ring 3 works: user GDT descriptors (sysret-ready layout), TSS.rsp0,
U/S-bit user mappings (W^X preserved), an int 0x80 syscall gate with a
mutable trap frame, and a setjmp-style enter/exit path. /sbin/init is a
real freestanding Zig binary built from sbin/, shipped on the ESP,
loaded by the bootloader (BootInfo.init_base/len), validated and mapped
by an in-kernel user-ELF loader, and run at CPL 3 — syscalls: exit,
ping, write. Tests: user, user-pf (U/S isolation proof, error code
0x5), init. Suite 27/27.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

src/root.zig

@@ -109,4 +109,10 @@ pub const BootInfo = extern struct {
     /// A device-tree boot path leaves this 0 and (later) fills a `device_tree_blob`
     /// field instead, so the kernel discovers devices without knowing what booted it.
     acpi_rsdp: u64 = 0,
+    /// The raw `/sbin/init` ELF image, read off the boot volume by the loader
+    /// into memory that survives the handoff (classified reserved, so the kernel
+    /// identity-maps it and never allocates over it). 0/0 = no init found — the
+    /// kernel boots without user space. Grows into a full initrd handoff later.
+    init_base: u64 = 0,
+    init_len: u64 = 0,
 };