Add input module: broadcast keyboard events over IPC

Programs can now subscribe to keyboard events (key_down/key_up/key_press)
and drivers can broadcast them, through a new user-space input service.

The delivery model is forced by danos IPC: a synchronous rendezvous holds
one pending reply, so a server cannot park N subscribers blocked in a
"wait for next event" call — delivery must be push. But a synchronous push
has no timeout and the kernel never wakes a sender parked on a dead peer's
endpoint, so one dying subscriber would hang all input. So this lands the
roadmap's planned asynchronous buffered send and builds the service on it:

- ipc_send (syscall 26): non-blocking post to an endpoint's bounded payload
  ring, delivered through reply_wait as a buffered message (notify_message_bit).
  A full ring drops the oldest. It can never hang on a dead/slow peer.
- input-protocol + runtime.input helpers (subscribe/next, connectSource/
  publish) — the first real consumer of M13 capability passing: a subscriber
  hands the service its own endpoint as a capability.
- input service (fan-out via ipc_send, dead-subscriber pruning), a synthetic
  input-source, and input-test; the ps2-bus keyboard driver publishes to it.
  Real IRQ1 scancode decoding (which must live in the bus, the PNP0303 owner)
  is a documented follow-up; the source is synthetic for now.
- build/init wiring, an `input` QEMU case, and docs/input.md.

Full QEMU suite 48/48, including the new input case and every IPC/endpoint
regression (ipc, ipc-call, ipc-cap, vfs, hpet, bus, irqfree).

system/kernel/process.zig

@@ -183,6 +183,7 @@ fn system_call(state: *architecture.CpuState) void {
         .ipc_lookup => systemIpcLookup(state),
         .ipc_call => systemIpcCall(state),
         .ipc_reply_wait => systemIpcReplyWait(state),
+        .ipc_send => systemIpcSend(state),
         .device_enumerate => systemDeviceEnumerate(state),
         .device_claim => systemDeviceClaim(state),
         .mmio_map => systemMmioMap(state),
@@ -263,6 +264,18 @@ fn systemIpcReplyWait(state: *architecture.CpuState) void {
     architecture.setSystemCallResult3(state, received_cap);
 }
 
+/// ipc_send(handle, message_ptr, message_len) -> 0/-errno: post a payload to an
+/// endpoint's async queue and wake a receiver, without blocking the caller. The async
+/// counterpart of ipc_call — for broadcasts (the input service) where a rendezvous would
+/// let one dead subscriber hang the sender. Delivered through ipc_reply_wait as a
+/// buffered message (badge carries notify_message_bit and the caller's task id).
+fn systemIpcSend(state: *architecture.CpuState) void {
+    const me = scheduler.current();
+    const endpoint = ipc.resolveHandle(me, architecture.systemCallArg(state, 0)) orelse return failErr(state, ipc.EBADF);
+    const r = ipc.send(endpoint, me.aspace, architecture.systemCallArg(state, 1), architecture.systemCallArg(state, 2), me.id);
+    architecture.setSystemCallResult(state, @bitCast(r));
+}
+
 /// device_enumerate(buffer, maximum) -> total: snapshot the device table into the caller's
 /// buffer (up to `maximum` entries), returning the total device count.
 fn systemDeviceEnumerate(state: *architecture.CpuState) void {