C6: update docs for the library/kernel + client split

Rewrote the repository-layout and driver-model docs to describe the new tree —
library/kernel (the kernel32-style system library: syscall surface split by
concern), library/device (mmio/model/pci/usb/acpi/driver/block), library/client
(display, input service clients), library/protocol (wire contracts) — and swept
the reference docs off the retired runtime shim:

  runtime.system.*  -> logging.* / time.* / process.* / memory.*
  runtime.dma.* / runtime.shared_memory.* / runtime.allocator -> memory.*
  runtime.ipc/process/time/service/Thread/block/display/input -> the module name
  runtime.device / runtime.device_manager -> driver
  library/runtime/<file>.zig -> its new home (kernel/ client/ device/)

docs/README.md (repository layout + source map), docs/driver-model.md (the module
graph + import lists), and the concern/reference docs (ipc, threading, timers,
logging, power, process-lifecycle, device-manager, display, vdso, sysv, drivers,
input, vfs-protocol, coding-standards, ...) now reflect the split. "runtime" that
remains is the userspace-library *concept*, which is still accurate.

The historical plan docs (display-plan, display-v2-plan, threading-plan) and the
zig-self-hosting design note are left as point-in-time snapshots.

docs/process-lifecycle.md

@@ -6,7 +6,7 @@ harness are all in — the interface below is as-built. The primitives underneat
 predate this design ([process-management.md](process-management.md):
 spawn, the supervision link, kill, child-exit notifications); this document designs
 the layer above them — the standard vocabulary a danos process speaks about its own
-life, and the stable `runtime.process` interface that carries it. Nothing here is
+life, and the stable `process` interface that carries it. Nothing here is
 device- or driver-specific: a driver, the VFS, and a user application all stop,
 reload, and die the same way. The device manager is simply this design's first
 serious customer ([device-manager.md](device-manager.md)).
@@ -184,7 +184,7 @@ zombie state or privileged snooping:
    same encoding supervisors already decode, the IRQ-as-IPC pattern once more). The
    subscriber filters for ids it holds state for and releases what the dead client
    held. Correlating is free of bookkeeping: an IPC sender's badge already *is* its
-   task id (`runtime.ipc.Received`), so the id a service has been keying client
+   task id (`ipc.Received`), so the id a service has been keying client
    state by all along is the id the exit event carries.
 
    Subscription, not broadcast-to-everyone: only processes that asked receive
@@ -200,9 +200,9 @@ its clients cleaning up after themselves.** Handle release on client death is th
 service's job, triggered by the published exit event — never by a courtesy
 "closing now" message that a crashed client will never send.
 
-## The stable interface: `runtime.process`
+## The stable interface: `process`
 
-`runtime.process` already owns what a process receives at birth (`Init`, the
+`process` already owns what a process receives at birth (`Init`, the
 argv contract). It grows to own the other end of life.
 
 **The runtime is the stable interface; the numbers are not.** danos applications do
@@ -283,7 +283,7 @@ callbacks (`on_terminate`, `on_reload`) for programs that want defaults.
 
 ### The service harness
 
-`runtime.service` owns the `replyWait` loop and folds every event source — signals,
+`service` owns the `replyWait` loop and folds every event source — signals,
 child exits, protocol messages — into callbacks, with the vocabulary's defaults:
 `terminate` returns from the loop (clean exit), the common `ping` is answered automatically,
 `reload` is ignored unless overridden. One loop, no locking, nothing reentrant. A
@@ -312,12 +312,12 @@ get POSIX; danos-native programs never pay for it.
    kill a claiming driver, spawn it again, the claim succeeds.
 2. **Exit reason in the death notification** (`ExitReason` above).
 3. **Exit events**: `process_subscribe` in the kernel (bounded subscriber table,
-   publishes on every death), `runtime.process.subscribeExits`; the userspace VFS
+   publishes on every death), `process.subscribeExits`; the userspace VFS
    router was the first subscriber — releasing a dead client's handles was its
    proof test — and the FAT server inherited the role when the router moved into
    the kernel (clients now hold the filesystem server's node ids directly).
 4. **Signals**: `signal_bind` + `process_signal` + the pending mask in the kernel;
-   `runtime.process` grows the interface above; the service harness handles
+   `process` grows the interface above; the service harness handles
    `terminate` and answers the common `ping`; `stop()` for supervisors.
 
 [device-manager.md](device-manager.md) builds directly on all four.