Wire real PS/2 scancodes through to input events and characters

Replace the keyboard driver's synthetic stream with the real path:

- ps2-bus binds IRQ1 (interrupt bits set only after the bind), drains
  port 0x60 on each interrupt, and forwards every byte to the attached
  child driver over async ipc_send, routed by the status register's
  auxiliary-output bit. Children attach via the new well-known ps2_bus
  service, handing over their endpoint as a capability.
- scancode.zig (new, pure, host-tested): scancode set 2 -> USB HID
  usage decoding (F0/E0/E1 prefix state machine) plus keyboard state —
  pressed-key bitmap, typematic-repeat classification, modifier and
  caps-lock tracking.
- keyboard.zig decodes the forwarded stream and publishes real
  key_down/key_press/key_up events, filling key_press characters via
  xkeyboard-config (layout from argv[2], default us) and synthesizing
  ASCII control characters for Enter/Tab/Backspace/Escape.
- protocol.zig names the full HID usage set in Keycode; build.zig
  threads the xkeyboard-config module into user binaries.

Verified end to end in QEMU via monitor sendkey: shift, caps lock,
and control-character synthesis all decode correctly. The mouse
driver still publishes its synthetic stream; attaching it to the
bus the same way is the follow-up.

docs/input.md

@@ -108,22 +108,29 @@ the service delivers to its endpoint, which only the same thread could receive).
 
 ## Status and follow-ups
 
-- **Synthetic sources, for now.** The `ps2-bus` driver owns PNP0303, which carries *both*
-  the 0x60/0x64 ports and IRQ1, so reading real scancodes/packets has to live in the bus,
-  not in [keyboard.zig](../system/drivers/ps2-bus/keyboard.zig) /
-  [mouse.zig](../system/drivers/ps2-bus/mouse.zig). Until that lands, the keyboard driver
-  publishes a synthetic key stream, the mouse driver a synthetic motion/click stream, and
-  the hardware-free `input-source` rotates through all three classes (including a synthetic
-  joystick, which has no driver yet) — all via the `input.synthetic*Event` helpers. The
-  fan-out and per-device routing are real; only the bytes are placeholder. **Follow-up:** the
-  bus binds IRQ1/IRQ12, reads port 0x60, and `ps2-library` decodes scan-set-1 →
-  keycodes and mouse packets; the drivers publish decoded events.
-- **Keycode → character** is a keymap, and danos has one:
-  [`library/xkeyboard-config`](../library/xkeyboard-config/README.md) compiles the X11
-  xkeyboard-config layouts (us, gb, de, fr, …) to native Zig —
-  `xkb.map(layout, keycode, mods)` → keysym + Unicode character. Wiring it in to fill a
-  `key_press` event's `character` (in the keyboard driver, or a small keymap service) is the
-  natural next step.
+- **The keyboard is real.** The `ps2-bus` driver owns PNP0303, which carries *both* the
+  0x60/0x64 ports and IRQ1, so reading the hardware lives in the bus, not in
+  [keyboard.zig](../system/drivers/ps2-bus/keyboard.zig): the bus binds IRQ1 and, on each
+  interrupt, drains port 0x60, routing every byte by the status register's
+  auxiliary-output bit to whichever child driver **attached** for that device (an
+  `AttachRequest` to the well-known `ps2_bus` service, carrying the child's endpoint as a
+  capability; the bytes then arrive as asynchronous `ForwardedByte` messages, so the IRQ
+  path never blocks on a child). The keyboard driver decodes the stream — scancode **set 2**,
+  what the keyboard sends with the 8042's legacy translation off, decoded by
+  [scancode.zig](../system/drivers/ps2-bus/scancode.zig) into USB HID usage keycodes with
+  make/break, typematic-repeat, and modifier tracking (host-tested under `zig build test`) —
+  and publishes real `key_down`/`key_press`/`key_up` events.
+- **Keycode → character** is wired in: the keyboard driver fills a `key_press` event's
+  `character` through [`library/xkeyboard-config`](../library/xkeyboard-config/README.md)
+  (`xkb.map(layout, keycode, mods)` → keysym + Unicode character), synthesizing the ASCII
+  control characters for Enter/Tab/Backspace/Escape, whose keysyms map to no Unicode. The
+  layout defaults to `us`; the bus can pass another as the driver's argv[2] — the seam for
+  a future settings source.
+- **The mouse is still synthetic.** [mouse.zig](../system/drivers/ps2-bus/mouse.zig)
+  publishes a placeholder motion/click stream; the hardware-free `input-source` likewise
+  rotates through all three classes (including a synthetic joystick, which has no driver
+  yet) via the `input.synthetic*Event` helpers. **Follow-up:** the mouse driver attaches to
+  the bus the way the keyboard does and decodes 3/4-byte packets into mouse events.
 - **Drop-oldest under overflow** is a defined loss; the 16-slot ring absorbs normal bursts.
   Real backpressure/flow-control is future work.
 - **`publish` is unauthenticated** — any process may publish, consistent with the current