reorg: split the runtime into library/kernel concern modules (C1)

The one giant `runtime` module (with a `system.zig` that was itself a dumping
ground of unrelated syscalls) is split into directly-importable, flat concern
modules under library/kernel/:

  system-call  ipc  memory  process  thread  time  logging  file-system  service  start
  (+ the device/service clients: device, device-manager, block, display, input)

system.zig is dissolved — its functions moved to their concern home (mmap ->
memory, spawn/kill/exit -> process, sleep/clock -> time, write/klog -> logging,
fs* -> file-system). `memory` merges heap+dma+shared-memory behind one flat API
(memory.allocator/dmaAlloc/sharedCreate/mmap), keeping heap's state and malloc
export single. The memory<->thread dependency cycle (heap needs Thread.Mutex,
thread needs mmap) is broken by having thread allocate its own stack via the raw
mmap syscall, so the module graph is a DAG.

This is the atomic step: all 42 internal cross-imports flip from relative to
module imports at once. `runtime.zig` and `system.zig` become thin re-export
SHIMS so the ~38 consumers keep compiling on `runtime.*` untouched; they migrate
to direct imports in C2, after which the shims are deleted (C5).

zig build + zig build test green; 14 QEMU cases pass (smoke, process,
process-kill, thread-spawn/join, logger, vfs, fat-mount, display-native,
usb-storage, virtio-gpu, device-manager, input, power-button).

library/kernel/process.zig

@@ -7,9 +7,9 @@
 
 const std = @import("std");
 const abi = @import("abi");
-const sc = @import("system-call.zig");
-const ipc = @import("ipc.zig");
-const system = @import("system.zig");
+const sc = @import("system-call");
+const ipc = @import("ipc");
+const time = @import("time");
 
 /// Everything a program receives at entry. Passed to
 /// `pub fn main(init: runtime.process.Init)`; programs that need nothing keep
@@ -112,14 +112,14 @@ pub fn sendSignal(id: u32, signal: Signal) bool {
 /// (arm `system.timerOnce`, keep serving) instead of calling this.
 pub fn stop(id: u32, deadline_ms: u64, exit_endpoint: usize) void {
     _ = sendSignal(id, .terminate);
-    _ = system.timerOnce(exit_endpoint, deadline_ms);
+    _ = time.timerOnce(exit_endpoint, deadline_ms);
     var receive: [8]u8 = undefined;
     while (true) {
         const got = ipc.replyWait(exit_endpoint, &.{}, &receive, null);
         if (got.isChildExit() and got.childProcessId() == id) return;
         if (got.isTimer()) break; // the deadline passed first — escalate
     }
-    _ = system.kill(id);
+    _ = kill(id);
     while (true) {
         const got = ipc.replyWait(exit_endpoint, &.{}, &receive, null);
         if (got.isChildExit() and got.childProcessId() == id) return;
@@ -135,3 +135,78 @@ pub fn stop(id: u32, deadline_ms: u64, exit_endpoint: usize) void {
 pub fn subscribeExits(endpoint: usize) bool {
     return sc.systemCall1(.process_subscribe, endpoint) == 0;
 }
+
+// --- raw process syscalls, formerly in the system.zig dumping ground ---
+
+/// One `processes` entry — re-exported from the shared ABI so a program can declare its
+/// snapshot buffer without importing `abi` itself.
+pub const ProcessDescriptor = abi.ProcessDescriptor;
+
+/// Give up the rest of this quantum.
+pub fn yield() void {
+    _ = sc.systemCall0(.yield);
+}
+
+/// End the process. Never returns.
+pub fn exit(code: usize) noreturn {
+    _ = sc.systemCall1(.exit, code);
+    unreachable; // the kernel never returns from exit
+}
+
+/// Start the binary bundled in the initial-ramdisk under `name` as a new ring-3 process,
+/// returning the child's process id (or null). argv[0] is `name`, and the caller becomes
+/// its **supervisor** — the only process allowed to `kill` it.
+pub fn spawn(name: []const u8) ?u32 {
+    return spawnSupervised(name, &.{}, null);
+}
+
+/// Like `spawn`, but hands the child argv[1..] (argv[0] is still `name`).
+pub fn spawnWithArguments(name: []const u8, arguments: []const []const u8) ?u32 {
+    return spawnSupervised(name, arguments, null);
+}
+
+/// The full spawn: argv[1..] for the child, and an optional endpoint the kernel notifies
+/// when the child ends (any way — clean exit, fault, or `kill`), delivered via
+/// `ipc.replyWait` as a child-exit badge (`ipc.Received.isChildExit`/`childProcessId`), so
+/// one endpoint can supervise many children. Returns the child's process id, or null.
+pub fn spawnSupervised(name: []const u8, arguments: []const []const u8, exit_endpoint: ?usize) ?u32 {
+    var blob: [256]u8 = undefined;
+    var len: usize = 0;
+    for (arguments, 0..) |argument, i| {
+        if (i != 0) {
+            if (len >= blob.len) return null;
+            blob[len] = 0;
+            len += 1;
+        }
+        if (len + argument.len > blob.len) return null;
+        @memcpy(blob[len..][0..argument.len], argument);
+        len += argument.len;
+    }
+    const r = sc.systemCall5(.system_spawn, @intFromPtr(name.ptr), name.len, if (len == 0) 0 else @intFromPtr(&blob), len, exit_endpoint orelse abi.no_cap);
+    if (r > ~@as(usize, 0) - 4095) return null; // a wrapped -errno
+    return @intCast(r);
+}
+
+/// Snapshot the process table into `out` and return the total number of live processes
+/// (which may exceed `out.len`; call again with a larger buffer). Kernel tasks are
+/// included, with an empty name. The primitive `ps` is built on.
+pub fn processes(out: []ProcessDescriptor) usize {
+    return sc.systemCall2(.process_enumerate, @intFromPtr(out.ptr), out.len);
+}
+
+/// Whether a process spawned under `name` (its argv[0]) is currently alive.
+pub fn isProcessRunning(name: []const u8) bool {
+    var table: [32]ProcessDescriptor = undefined;
+    const total = processes(&table);
+    for (table[0..@min(total, table.len)]) |descriptor| {
+        if (std.mem.eql(u8, descriptor.name[0..descriptor.name_length], name)) return true;
+    }
+    return false;
+}
+
+/// End process `id`. Only its supervisor — the process that spawned it — may; anyone else
+/// gets false, as does a stale or unknown id. Delivery is prompt but asynchronous, like a
+/// signal. True means the kill is accepted and irrevocable.
+pub fn kill(id: u32) bool {
+    return sc.systemCall1(.process_kill, id) == 0;
+}