Re-organize the source tree as a monorepo mirroring the FHS

The source layout now mirrors the runtime filesystem hierarchy
(docs/danos-file-system-hierarchy-FSH.md): what lives under system/ in the
source is what a running danos represents under /system. Each service and
driver is a sub-project directory that is its own Zig module — cross-project
references go by module name, never by a path into another project's files.

Moves (all git mv, history preserved):
- src/            -> system/            (danos internals; the self-representation)
    root.zig      -> danos.zig          (the kernel<->user contract module)
    kernel/arch/  -> kernel/architecture/   (arch -> architecture)
    device/       -> devices/           (what /system/devices reflects)
    boot/         -> /boot              (the loaders, top level)
- sbin/           -> split by role:
    init, vfs     -> system/services/<name>/<name>.zig
    hpetd, busd   -> system/drivers/<name>/<name>.zig
    vfs-test      -> system/services/vfs/vfs-test.zig  (inside the vfs project)
- lib/            -> library/runtime/   (room for other libraries beside runtime)

The VFS wire protocol becomes its own module, system/services/vfs/protocol.zig
("vfs-protocol"): the vfs sub-project exposes its interface, and the runtime's
file layer imports it by name. First instance of the "protocol module" pattern
(docs/driver-model.md); usb/block will expose theirs the same way.

Also: fix a naming-standard violation in the protocol — Op -> Operation (and
req -> request, _pad -> _padding). Docs updated: /system/services added to the
FHS doc, a repository-layout section added to the docs index, and stale source
paths swept across comments and docs.

Runtime boot paths are unchanged (the bootloader still loads /sbin/init);
aligning the runtime filesystem to the FHS is a separate follow-up. Suite 35/35
plus host tests green.

system/kernel/sync.zig

@@ -0,0 +1,80 @@
+//! The big kernel lock (BKL) — the coarse mutual exclusion that lets more than one
+//! CPU run kernel code safely.
+//!
+//! Until SMP, the kernel's mutual exclusion *was* the interrupt flag: a critical
+//! section did `cli`, and since only one core existed, nothing else could touch
+//! kernel state (the discipline in docs/scheduling.md). That invariant dies the
+//! instant a second core runs kernel code — `cli` on one core does nothing to
+//! another. So the kernel's shared state (the scheduler queues, IPC channels) is
+//! guarded by a spinlock, and the lock is **always held with local interrupts
+//! disabled**, so a core's own timer interrupt can't re-enter the kernel and
+//! deadlock against the lock it already holds.
+//!
+//! This is deliberately *one coarse lock*, not many fine ones: it's philosophically
+//! aligned with a tiny kernel and it keeps the single-core correctness model
+//! (docs/scheduling.md) largely intact — one lock around kernel entry instead of
+//! rethinking every critical section. It's the first-design choice seL4 makes and
+//! docs/smp.md endorses; per-core run queues + fine-grained locking come later, if
+//! contention ever bites. Because the kernel does little, the lock is held briefly.
+//!
+//! **The hand-off rule.** The lock is held *across* a context switch and released
+//! by whichever task resumes, not by the one that switched away. A task that blocks
+//! or yields calls `enter`, mutates the queues, `schedule()`s — switching to another
+//! task *with the lock still held* — and only calls `leave` once it is eventually
+//! resumed and its critical section runs to the end. So every call into `schedule()`
+//! (and thus `switch_context`) happens with the lock held, and every task resumes
+//! from a switch holding it. A freshly-spawned task has no `enter`/`leave` frame to
+//! resume into, so `task_trampoline` releases the lock explicitly on its behalf via
+//! `releaseForFreshTask` before running the task body.
+
+const std = @import("std");
+const architecture = @import("architecture");
+
+/// 0 = free, 1 = held. A single global lock for the whole kernel.
+var held = std.atomic.Value(u32).init(0);
+
+/// Enter the kernel: disable interrupts on this core, then spin until we own the
+/// lock. Returns the caller's prior interrupt flags for `leave` to restore.
+/// Interrupts stay off for the whole critical section so this core's timer tick
+/// can't try to re-acquire the lock we're holding.
+pub fn enter() u64 {
+    const flags = architecture.saveInterrupts();
+    acquire();
+    return flags;
+}
+
+/// Release the lock and restore the interrupt flags `enter` returned (re-enabling
+/// interrupts only if they were on beforehand). The normal exit for a critical
+/// section reached from task context (`yield`, `sleep`, `wait`, `wake`, IPC).
+pub fn leave(flags: u64) void {
+    release();
+    architecture.restoreInterrupts(flags);
+}
+
+/// Release the lock but leave interrupts as they are. The exit for a critical
+/// section running inside an interrupt handler (the timer `tick`): the handler's
+/// `iretq` is what restores the interrupted context's flags, so restoring them
+/// here too would open a nested-interrupt window before the return. Release only.
+pub fn leaveIsr() void {
+    release();
+}
+
+/// Release the lock on behalf of a freshly-spawned task. Such a task is switched to
+/// (with the lock held) but has no `enter`/`leave` frame of its own to release
+/// through — `task_trampoline` calls this before running the task body. Interrupts
+/// are enabled separately by the trampoline. Exported for the assembly trampoline.
+export fn releaseForFreshTask() callconv(.c) void {
+    release();
+}
+
+fn acquire() void {
+    // Test-and-test-and-set: try once, then spin read-only until the lock looks
+    // free before retrying the (bus-locked) swap — cheaper on the coherency fabric.
+    while (held.swap(1, .acquire) != 0) {
+        while (held.load(.monotonic) != 0) architecture.cpuRelax();
+    }
+}
+
+fn release() void {
+    held.store(0, .release);
+}