C6: update docs for the library/kernel + client split

Rewrote the repository-layout and driver-model docs to describe the new tree —
library/kernel (the kernel32-style system library: syscall surface split by
concern), library/device (mmio/model/pci/usb/acpi/driver/block), library/client
(display, input service clients), library/protocol (wire contracts) — and swept
the reference docs off the retired runtime shim:

  runtime.system.*  -> logging.* / time.* / process.* / memory.*
  runtime.dma.* / runtime.shared_memory.* / runtime.allocator -> memory.*
  runtime.ipc/process/time/service/Thread/block/display/input -> the module name
  runtime.device / runtime.device_manager -> driver
  library/runtime/<file>.zig -> its new home (kernel/ client/ device/)

docs/README.md (repository layout + source map), docs/driver-model.md (the module
graph + import lists), and the concern/reference docs (ipc, threading, timers,
logging, power, process-lifecycle, device-manager, display, vdso, sysv, drivers,
input, vfs-protocol, coding-standards, ...) now reflect the split. "runtime" that
remains is the userspace-library *concept*, which is still accurate.

The historical plan docs (display-plan, display-v2-plan, threading-plan) and the
zig-self-hosting design note are left as point-in-time snapshots.

docs/vfs-protocol.md

@@ -1,6 +1,6 @@
 # The VFS wire protocol
 
-> **Status:** built and spoken today between `runtime.fs` (the client) and the
+> **Status:** built and spoken today between `file_system` (the client) and the
 > filesystem BACKENDS (the FAT server). The mount router lives in the
 > **kernel** (`system/kernel/vfs.zig`): `fs_resolve` routes a path and either
 > serves it directly (the read-only /system initrd mount, via `fs_node`) or
@@ -113,7 +113,7 @@ Notes per operation:
   prefix maps a mount into the backend's namespace (fat serves `/mnt/usb`
   from its volume root and `/var` from its `/var` subtree).
 - **rename** — same-directory rename only: the backend compares the old and
-  new parent paths and refuses a mismatch. The client (`runtime.fs`) refuses
+  new parent paths and refuses a mismatch. The client (`file_system`) refuses
   earlier when the two paths resolve to different backend endpoints, but that
   check is coarser than "one mount" — one endpoint can serve several mounts
   (fat serves `/mnt/usb` and `/var`), so a cross-mount rename reaches the