M2 step 3: route every physical dereference through the physmap

paging.init now builds the physmap (physToVirt(phys)) alongside the low
identity map, so both addressing modes resolve during the transition.
tableAt (the page-table walk hinge), the pmm bitmap, the framebuffer,
LAPIC/IOAPIC/HPET/PM-timer/SPCR MMIO, the ACPI table walk, AML
OperationRegions, the ACPI power registers, the user-ELF frame fills,
and the AP trampoline arm/disarm all reach physical memory through the
physmap. Hal.mapMmio now maps into the physmap and returns the virtual
address, so the device layer never learns the layout. boot_info and its
pointees are converted at kmain entry. The kernel still links and runs
low; identity is the safety net until it's removed. Suite 27/27.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

src/kernel/pmm.zig

@@ -49,12 +49,16 @@ inline fn setFree(frame: usize) void {
 }
 
 fn regions(map: danos.MemoryMap) []const danos.MemoryRegion {
-    return @as([*]const danos.MemoryRegion, @ptrFromInt(map.regions))[0..map.len];
+    return @as([*]const danos.MemoryRegion, @ptrFromInt(danos.physToVirt(map.regions)))[0..map.len];
 }
 
-/// Build the allocator from the loader's memory map. Relies on the firmware's
-/// identity mapping still being in effect (a physical address is usable directly
-/// as a pointer) — true until the kernel installs its own page tables.
+/// Build the allocator from the loader's memory map. Reaches physical memory
+/// (the region array, the bitmap's own storage) through the physmap, which the
+/// loader's bootstrap tables already provide — so this works before the kernel
+/// installs its own tables. Invariant: the bitmap lands in the first usable
+/// region (lowest address), which must sit under the bootstrap physmap's reach
+/// (4 GiB); it always does, as both this and the page-table allocator scan from
+/// low addresses up.
 pub fn init(map: danos.MemoryMap) void {
     const regs = regions(map);
 
@@ -87,7 +91,7 @@ pub fn init(map: danos.MemoryMap) void {
         }
     }
     const bitmap_base = storage orelse @panic("pmm: no region large enough for the frame bitmap");
-    bitmap = @as([*]u8, @ptrFromInt(bitmap_base))[0..bitmap_bytes];
+    bitmap = @as([*]u8, @ptrFromInt(danos.physToVirt(bitmap_base)))[0..bitmap_bytes];
 
     // 3. Start with everything marked used, then free the usable regions. Doing
     //    it this way means every gap, reserved span and MMIO hole is unallocatable