M2 step 3: route every physical dereference through the physmap

paging.init now builds the physmap (physToVirt(phys)) alongside the low
identity map, so both addressing modes resolve during the transition.
tableAt (the page-table walk hinge), the pmm bitmap, the framebuffer,
LAPIC/IOAPIC/HPET/PM-timer/SPCR MMIO, the ACPI table walk, AML
OperationRegions, the ACPI power registers, the user-ELF frame fills,
and the AP trampoline arm/disarm all reach physical memory through the
physmap. Hal.mapMmio now maps into the physmap and returns the virtual
address, so the device layer never learns the layout. boot_info and its
pointees are converted at kmain entry. The kernel still links and runs
low; identity is the safety net until it's removed. Suite 27/27.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

src/device/device.zig

@@ -18,7 +18,10 @@ const std = @import("std");
 /// layer touches hardware without importing `arch` — the same discipline that lets
 /// it stay firmware-agnostic. `pioRead`/`pioWrite` take a width in bytes (1/2/4).
 pub const Hal = struct {
-    mapMmio: *const fn (virt: u64, phys: u64, writable: bool) void,
+    /// Map a physical MMIO range and return the virtual address to reach it at.
+    /// The device layer dereferences the returned address and never learns how
+    /// the kernel places it (identity, physmap, a window — the kernel's choice).
+    mapMmio: *const fn (phys: u64, len: u64, writable: bool) u64,
     pioRead: *const fn (width: u8, port: u16) u32,
     pioWrite: *const fn (width: u8, port: u16, value: u32) void,
 };