M10: IO passthrough (MMIO grants) + first real driver (hpetd)

A user-space process can now touch real hardware directly, capability-gated by
the device tree — the microkernel driver model.

- src/kernel/devsvc.zig: flattens the discovered device tree into an
  id-indexed snapshot + a claim table at boot (devsvc.init from main.zig).
- Syscalls 11-13: dev_enumerate (snapshot the table), dev_claim (take
  exclusive ownership), mmio_map (map a claimed device's MMIO window into the
  caller's AS and return the register base). The claim is the capability:
  mmio_map refuses any device the caller doesn't own.
- paging.mapUserDeviceInto: maps device MMIO strong-uncacheable (PCD|PWT) and
  marks each leaf with a device_grant PTE bit; freeSubtree skips pmm.free on
  those leaves, so tearing down a driver never returns MMIO frames to the RAM
  pool (the teardown hazard). MMIO grants live in a distinct arena, PML4[226]
  (Task.dev_map_next), so device pages widen no kernel mapping.
- lib/dev.zig: user enumerate/claim/mmioMap wrappers; shared DeviceDesc/ResDesc
  in danos (root.zig). sbin/hpetd.zig: finds the HPET, claims it, maps its
  registers, enables the counter (an MMIO write) and reads it (0xF0) — proving
  read+write passthrough to real hardware.
- Tests: `hpet` (driver reads the counter advancing from ring 3) and `iopass`
  (device-granted frame survives address-space teardown). Suite 33/33.

irq_bind/irq_ack (IRQ-as-message) are stubbed (-1) pending; notifyFromIsr (M7)
is the hook they'll use.

build.zig

@@ -219,6 +219,7 @@ pub fn build(b: *std.Build) void {
     // which unpacks it and spawns each program (src/user/proto/initrd.zig).
     const vfs_exe = addUserBinary(b, kernel_target, rt_mod, "vfs", "sbin/vfs.zig");
     const vfstest_exe = addUserBinary(b, kernel_target, rt_mod, "vfstest", "sbin/vfstest.zig");
+    const hpetd_exe = addUserBinary(b, kernel_target, rt_mod, "hpetd", "sbin/hpetd.zig");
 
     // Pack the user binaries into the initrd image with the host-side Python tool
     // (the container format is trivial, and Python sidesteps std API churn). Args:
@@ -230,6 +231,8 @@ pub fn build(b: *std.Build) void {
     mk_run.addFileArg(vfs_exe.getEmittedBin());
     mk_run.addArg("vfstest");
     mk_run.addFileArg(vfstest_exe.getEmittedBin());
+    mk_run.addArg("hpetd");
+    mk_run.addFileArg(hpetd_exe.getEmittedBin());
 
     // Install the image to zig-out/bin (so the QEMU test harness picks it up like
     // the other binaries). The run-x86-64 ESP install is added below.