C6: update docs for the library/kernel + client split

Rewrote the repository-layout and driver-model docs to describe the new tree —
library/kernel (the kernel32-style system library: syscall surface split by
concern), library/device (mmio/model/pci/usb/acpi/driver/block), library/client
(display, input service clients), library/protocol (wire contracts) — and swept
the reference docs off the retired runtime shim:

  runtime.system.*  -> logging.* / time.* / process.* / memory.*
  runtime.dma.* / runtime.shared_memory.* / runtime.allocator -> memory.*
  runtime.ipc/process/time/service/Thread/block/display/input -> the module name
  runtime.device / runtime.device_manager -> driver
  library/runtime/<file>.zig -> its new home (kernel/ client/ device/)

docs/README.md (repository layout + source map), docs/driver-model.md (the module
graph + import lists), and the concern/reference docs (ipc, threading, timers,
logging, power, process-lifecycle, device-manager, display, vdso, sysv, drivers,
input, vfs-protocol, coding-standards, ...) now reflect the split. "runtime" that
remains is the userspace-library *concept*, which is still accurate.

The historical plan docs (display-plan, display-v2-plan, threading-plan) and the
zig-self-hosting design note are left as point-in-time snapshots.

docs/vdso.md

@@ -1,7 +1,7 @@
 # The vDSO — the public system-call boundary
 
 > **Status:** design note, not built. The runtime today issues raw `syscall`
-> instructions from `library/runtime/system-call.zig` using the numbers in
+> instructions from `library/kernel/system-call.zig` using the numbers in
 > `system/abi.zig`. This note designs the layer that replaces that arrangement:
 > a **kernel-supplied, C-ABI entry library** mapped into every process — the
 > only supported way into the kernel — so the raw numbers can stay private,
@@ -25,8 +25,8 @@ ourselves:
    this mistake: it issued XNU syscalls directly instead of going through
    libSystem, and macOS updates repeatedly broke every Go binary until Go
    switched to the library like everyone else.
-2. **Not everything is Zig.** A Rust or C program can't import the `runtime`
-   module. The public boundary has to be expressible in the one calling
+2. **Not everything is Zig.** A Rust or C program can't import the danos Zig
+   modules. The public boundary has to be expressible in the one calling
    convention every language speaks: the C ABI.
 3. **Randomised syscall numbers** — a hardening option we want open — only
    work if no user binary anywhere knows a number at build time. The binding
@@ -49,10 +49,10 @@ The public danos ABI then has exactly two layers, neither of which is
 
 | Layer | Contract | Spoken by |
 |-------|----------|-----------|
-| **vDSO** | C-ABI functions, this note | every language's thin shim (`runtime.system` for Zig, a `-sys` crate for Rust, a header for C) |
+| **vDSO** | C-ABI functions, this note | every language's thin shim (the `system-call` module for Zig, a `-sys` crate for Rust, a header for C) |
 | **IPC wire protocols** | byte layouts over `ipc_call` ([vfs-protocol.md](vfs-protocol.md) is the first one documented) | any client that can lay out bytes |
 
-Everything above those — the heap, `runtime.fs`, the service harness — is
+Everything above those — the heap, `file_system`, the service harness — is
 per-language convenience, compiled into each binary from source, exactly as
 today. Nothing about the Zig runtime's shape changes; it just stops being the
 *only* door.
@@ -107,7 +107,7 @@ convenience, not a requirement.)
 
 The kernel already builds a System V entry block — argc, argv, envp
 terminator, **auxiliary vector** — on every new process's stack
-(`buildEntryStack`, read by `runtime.start`). The vDSO base rides in a new
+(`buildEntryStack`, read by the `start` module). The vDSO base rides in a new
 auxv entry, exactly Linux's `AT_SYSINFO_EHDR` move. No new syscall, no magic
 address, and a language shim finds it the same portable way on every
 architecture.
@@ -183,11 +183,11 @@ second — but the design should never be sold as more than that.
 Phased so every step ships alone (the M-milestone discipline):
 
 1. **The blob + the table.** Build the vDSO, map it at spawn, deliver the
-   base via auxv. `runtime.system-call.zig` binds through the table when the
+   base via auxv. `library/kernel/system-call.zig` binds through the table when the
    auxv entry is present, falls back to raw `syscall` when absent — the whole
    tree keeps booting during the transition.
-2. **Cut the runtime over.** Delete the raw stubs; `runtime` no longer
-   imports the `SystemCall` numbers at all (`abi.zig`'s enum becomes
+2. **Cut the system library over.** Delete the raw stubs; the `system-call`
+   module no longer imports the `SystemCall` numbers at all (`abi.zig`'s enum becomes
    kernel-internal). The QEMU suite passing proves the table carries the
    whole system.
 3. **Enforce + randomise.** Add the `rip`-range check, then per-boot number