M3 step 3: syscall/sysret fast path

Per-core MSR setup (EFER.SCE, STAR, LSTAR, SFMASK) enables syscall; the
GDT layout was already chosen so sysret lands on CS 0x23 / SS 0x1B. A new
syscall_entry stub swaps in the kernel GS, switches to the task's kernel
stack via the per-CPU block, builds a CpuState frame identical to the
interrupt path's, and reuses interruptDispatch (vector 128) — then
sysretq back. enter_user now also publishes kernel_rsp so the borrowed
path's syscalls land on a good stack. /sbin/init uses the `syscall`
instruction. int 0x80 stays for the test blobs. Suite 27/27.

(Noted in the stub: sysretq #GPs in ring 0 on a non-canonical return
RIP — a hardening item once untrusted user code exists.)

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

sbin/init.zig

@@ -14,12 +14,14 @@ const sys_exit = 0;
 const sys_write = 2;
 
 fn syscall2(n: u64, a: u64, b: u64) u64 {
-    return asm volatile ("int $0x80"
+    // The `syscall` instruction clobbers RCX (return RIP) and R11 (saved RFLAGS);
+    // the kernel entry stub preserves everything else.
+    return asm volatile ("syscall"
         : [ret] "={rax}" (-> u64),
         : [n] "{rax}" (n),
           [a] "{rdi}" (a),
           [b] "{rsi}" (b),
-        : .{ .memory = true });
+        : .{ .rcx = true, .r11 = true, .memory = true });
 }
 
 fn write(msg: []const u8) void {