Re-organize the source tree as a monorepo mirroring the FHS

The source layout now mirrors the runtime filesystem hierarchy
(docs/danos-file-system-hierarchy-FSH.md): what lives under system/ in the
source is what a running danos represents under /system. Each service and
driver is a sub-project directory that is its own Zig module — cross-project
references go by module name, never by a path into another project's files.

Moves (all git mv, history preserved):
- src/            -> system/            (danos internals; the self-representation)
    root.zig      -> danos.zig          (the kernel<->user contract module)
    kernel/arch/  -> kernel/architecture/   (arch -> architecture)
    device/       -> devices/           (what /system/devices reflects)
    boot/         -> /boot              (the loaders, top level)
- sbin/           -> split by role:
    init, vfs     -> system/services/<name>/<name>.zig
    hpetd, busd   -> system/drivers/<name>/<name>.zig
    vfs-test      -> system/services/vfs/vfs-test.zig  (inside the vfs project)
- lib/            -> library/runtime/   (room for other libraries beside runtime)

The VFS wire protocol becomes its own module, system/services/vfs/protocol.zig
("vfs-protocol"): the vfs sub-project exposes its interface, and the runtime's
file layer imports it by name. First instance of the "protocol module" pattern
(docs/driver-model.md); usb/block will expose theirs the same way.

Also: fix a naming-standard violation in the protocol — Op -> Operation (and
req -> request, _pad -> _padding). Docs updated: /system/services added to the
FHS doc, a repository-layout section added to the docs index, and stale source
paths swept across comments and docs.

Runtime boot paths are unchanged (the bootloader still loads /sbin/init);
aligning the runtime filesystem to the FHS is a separate follow-up. Suite 35/35
plus host tests green.

library/runtime/runtime.zig

@@ -0,0 +1,30 @@
+//! danos user-space runtime library — a nascent libc. Every user binary (init,
+//! and later the VFS server + device drivers) imports this as `@import("runtime")`:
+//! system_call wrappers, the C-convention heap, IPC helpers, and the process start
+//! shim. It is compiled into each binary (inheriting its `.large` code model and
+//! freestanding target), so all user programs share one implementation.
+//!
+//! A user binary needs three lines:
+//!   const runtime = @import("runtime");
+//!   pub const panic = runtime.panic;
+//!   comptime { _ = &runtime.start._start; }   // pull the entry shim in
+//! and a `pub fn main() void`.
+
+pub const system = @import("system.zig");
+pub const heap = @import("heap.zig");
+pub const ipc = @import("ipc.zig");
+pub const start = @import("start.zig");
+/// The VFS wire protocol (shared with the VFS server).
+pub const vfs_protocol = @import("vfs-protocol");
+/// POSIX-style file API: open/read/write/lseek/stat/close.
+pub const unistd = @import("unistd.zig");
+/// C stdio: fopen/fread/fwrite/fseek/ftell/fclose over unistd.
+pub const stdio = @import("stdio.zig");
+/// Device access for drivers: enumerate/claim/mmioMap.
+pub const device = @import("device.zig");
+
+/// Re-exported so a user binary can `pub const panic = runtime.panic;`.
+pub const panic = start.panic;
+
+/// The heap as a `std.mem.Allocator`, for Zig `std` containers in user code.
+pub const allocator = heap.allocator;