M2 step 3: route every physical dereference through the physmap

paging.init now builds the physmap (physToVirt(phys)) alongside the low
identity map, so both addressing modes resolve during the transition.
tableAt (the page-table walk hinge), the pmm bitmap, the framebuffer,
LAPIC/IOAPIC/HPET/PM-timer/SPCR MMIO, the ACPI table walk, AML
OperationRegions, the ACPI power registers, the user-ELF frame fills,
and the AP trampoline arm/disarm all reach physical memory through the
physmap. Hal.mapMmio now maps into the physmap and returns the virtual
address, so the device layer never learns the layout. boot_info and its
pointees are converted at kmain entry. The kernel still links and runs
low; identity is the safety net until it's removed. Suite 27/27.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

src/kernel/arch/x86_64/cpu.zig

@@ -71,6 +71,13 @@ pub fn mapPage(virt: u64, phys: u64, writable: bool) void {
     paging.map(virt, phys, writable);
 }
 
+/// Map a device MMIO range and return the virtual address to reach it at. This
+/// is the device layer's `Hal.mapMmio` — it hands back a physmap pointer and
+/// never exposes how the mapping is placed.
+pub fn mapMmio(phys: u64, len: u64, writable: bool) u64 {
+    return paging.mapMmio(phys, len, writable);
+}
+
 /// Remove a kernel mapping.
 pub fn unmapPage(virt: u64) void {
     paging.unmap(virt);