M8: initrd handoff + multi-binary shipping

Ship more than one user binary: the bootloader now ferries an initrd bundle
(the VFS server + future drivers) alongside sbin/init, and the kernel unpacks
and spawns each program.

- src/user/proto/initrd.zig: the container format (Header{magic,count} +
  Entry{name[32],offset,len} + blobs) with a validating Reader, shared by the
  kernel and the packer.
- tools/mkinitrd.py: host-side packer (Python — trivial format, and sidesteps
  the reworked Zig 0.16 std fs/args API). build.zig runs it on the built user
  binaries via addSystemCommand and installs initrd.img to zig-out/bin + the
  ESP root.
- BootInfo gains initrd_base/initrd_len; efi.zig loadInit refactored into a
  shared loadFile, and loadInitrd ferries \initrd.img into surviving
  LoaderData like init.
- main.zig startInitrdBinaries(): parse the image, spawn every entry (kernel-
  spawns-all for now; init takes over via sys_spawn later).
- sbin/vfs.zig: a heartbeat stub (the real VFS server is M9), packed into the
  initrd to prove the pipeline.
- New `initrd` test: parse + spawn + confirm the vfs stub reaches ring 3 and
  heartbeats. Harness ships initrd.img on the ESP. Suite 30/30.

src/root.zig

@@ -182,4 +182,9 @@ pub const BootInfo = extern struct {
     /// kernel boots without user space. Grows into a full initrd handoff later.
     init_base: u64 = 0,
     init_len: u64 = 0,
+    /// The initrd image (a bundle of extra user binaries — the VFS server and
+    /// device drivers), read off the boot volume into memory that survives the
+    /// handoff, same as `init` above. 0/0 = no initrd. See src/user/proto/initrd.zig.
+    initrd_base: u64 = 0,
+    initrd_len: u64 = 0,
 };