Re-organize the source tree as a monorepo mirroring the FHS

The source layout now mirrors the runtime filesystem hierarchy
(docs/danos-file-system-hierarchy-FSH.md): what lives under system/ in the
source is what a running danos represents under /system. Each service and
driver is a sub-project directory that is its own Zig module — cross-project
references go by module name, never by a path into another project's files.

Moves (all git mv, history preserved):
- src/            -> system/            (danos internals; the self-representation)
    root.zig      -> danos.zig          (the kernel<->user contract module)
    kernel/arch/  -> kernel/architecture/   (arch -> architecture)
    device/       -> devices/           (what /system/devices reflects)
    boot/         -> /boot              (the loaders, top level)
- sbin/           -> split by role:
    init, vfs     -> system/services/<name>/<name>.zig
    hpetd, busd   -> system/drivers/<name>/<name>.zig
    vfs-test      -> system/services/vfs/vfs-test.zig  (inside the vfs project)
- lib/            -> library/runtime/   (room for other libraries beside runtime)

The VFS wire protocol becomes its own module, system/services/vfs/protocol.zig
("vfs-protocol"): the vfs sub-project exposes its interface, and the runtime's
file layer imports it by name. First instance of the "protocol module" pattern
(docs/driver-model.md); usb/block will expose theirs the same way.

Also: fix a naming-standard violation in the protocol — Op -> Operation (and
req -> request, _pad -> _padding). Docs updated: /system/services added to the
FHS doc, a repository-layout section added to the docs index, and stale source
paths swept across comments and docs.

Runtime boot paths are unchanged (the bootloader still loads /sbin/init);
aligning the runtime filesystem to the FHS is a separate follow-up. Suite 35/35
plus host tests green.

docs/smp.md

@@ -131,7 +131,7 @@ Whatever the top goal, the *sequence* is the same and seL4 validates starting si
    model you already have (the interrupt-flag discipline in
    [scheduling.md](scheduling.md)) stay largely intact: one lock around kernel entry
    instead of rethinking every critical section. **Done** — see
-   `src/kernel/sync.zig`.
+   `system/kernel/sync.zig`.
 4. **Later, if contention bites,** evolve toward **per-core run queues + explicit
    affinity** (the Fiasco.OC direction) — also the more real-time-predictable model.
 5. **Placement stays a user-space policy** — the kernel runs a thread on the core it's
@@ -151,7 +151,7 @@ next lands.
 - **Core enumeration** — the MADT parse records every usable Local APIC (with its
   `apic_id`, which an AP wake targets); `platform.cpus()` returns the list. See
   [discovery.md](discovery.md).
-- **The big kernel lock** (`src/kernel/sync.zig`) — one coarse spinlock guarding the
+- **The big kernel lock** (`system/kernel/sync.zig`) — one coarse spinlock guarding the
   scheduler queues and IPC, always held with local interrupts disabled. It is held
   *across* a context switch and released by whichever task resumes (the hand-off
   rule); `task_trampoline` releases it for a freshly-spawned task. `scheduler.zig` and
@@ -164,7 +164,7 @@ next lands.
   the highest-priority ready task; per-core queues are a later optimisation.
 - **AP wake to long mode** — `arch.startSecondary` drives INIT–SIPI–SIPI (via the
   LAPIC ICR) to wake each parked core one at a time. A woken core starts in 16-bit
-  real mode at a low page and runs the [trampoline](../src/kernel/arch/x86_64/trampoline.s)
+  real mode at a low page and runs the [trampoline](../system/kernel/architecture/x86_64/trampoline.s)
   up through protected mode into 64-bit long mode, then lands in `smp.zig:apEntry`,
   publishes its per-CPU pointer, and reports in. Verified in QEMU with `-smp 4`:
   all four cores report `online`.