M2 step 3: route every physical dereference through the physmap

paging.init now builds the physmap (physToVirt(phys)) alongside the low
identity map, so both addressing modes resolve during the transition.
tableAt (the page-table walk hinge), the pmm bitmap, the framebuffer,
LAPIC/IOAPIC/HPET/PM-timer/SPCR MMIO, the ACPI table walk, AML
OperationRegions, the ACPI power registers, the user-ELF frame fills,
and the AP trampoline arm/disarm all reach physical memory through the
physmap. Hal.mapMmio now maps into the physmap and returns the virtual
address, so the device layer never learns the layout. boot_info and its
pointees are converted at kmain entry. The kernel still links and runs
low; identity is the safety net until it's removed. Suite 27/27.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

src/kernel/tests.zig

@@ -110,7 +110,7 @@ pub fn run(case: []const u8, boot_info: *const BootInfo) void {
 
 fn platformHal() platform.Hal {
     return .{
-        .mapMmio = arch.mapPage,
+        .mapMmio = arch.mapMmio,
         .pioRead = arch.pioRead,
         .pioWrite = arch.pioWrite,
     };
@@ -552,7 +552,7 @@ fn smpTest() void {
     const tramp = arch.trampolinePage();
     check("trampoline frame reserved", tramp != 0);
     if (tramp != 0) {
-        const bytes: [*]const u8 = @ptrFromInt(tramp);
+        const bytes: [*]const u8 = @ptrFromInt(danos.physToVirt(tramp));
         var zeroed = true;
         for (0..4096) |b| {
             if (bytes[b] != 0) zeroed = false;
@@ -753,7 +753,7 @@ fn initTest(boot_info: *const BootInfo) void {
         result();
         return;
     }
-    const image = @as([*]const u8, @ptrFromInt(boot_info.init_base))[0..boot_info.init_len];
+    const image = @as([*]const u8, @ptrFromInt(danos.physToVirt(boot_info.init_base)))[0..boot_info.init_len];
     sched.setPreemption(false); // see userTest: pins the run to this core's rsp0
     const code = usermode.runInitElf(image);
     sched.setPreemption(true);