Re-organize the source tree as a monorepo mirroring the FHS

The source layout now mirrors the runtime filesystem hierarchy
(docs/danos-file-system-hierarchy-FSH.md): what lives under system/ in the
source is what a running danos represents under /system. Each service and
driver is a sub-project directory that is its own Zig module — cross-project
references go by module name, never by a path into another project's files.

Moves (all git mv, history preserved):
- src/            -> system/            (danos internals; the self-representation)
    root.zig      -> danos.zig          (the kernel<->user contract module)
    kernel/arch/  -> kernel/architecture/   (arch -> architecture)
    device/       -> devices/           (what /system/devices reflects)
    boot/         -> /boot              (the loaders, top level)
- sbin/           -> split by role:
    init, vfs     -> system/services/<name>/<name>.zig
    hpetd, busd   -> system/drivers/<name>/<name>.zig
    vfs-test      -> system/services/vfs/vfs-test.zig  (inside the vfs project)
- lib/            -> library/runtime/   (room for other libraries beside runtime)

The VFS wire protocol becomes its own module, system/services/vfs/protocol.zig
("vfs-protocol"): the vfs sub-project exposes its interface, and the runtime's
file layer imports it by name. First instance of the "protocol module" pattern
(docs/driver-model.md); usb/block will expose theirs the same way.

Also: fix a naming-standard violation in the protocol — Op -> Operation (and
req -> request, _pad -> _padding). Docs updated: /system/services added to the
FHS doc, a repository-layout section added to the docs index, and stale source
paths swept across comments and docs.

Runtime boot paths are unchanged (the bootloader still loads /sbin/init);
aligning the runtime filesystem to the FHS is a separate follow-up. Suite 35/35
plus host tests green.

system/services/init/init.zig

@@ -0,0 +1,39 @@
+//! /sbin/init — the first user-space program, PID 1. Built as its own
+//! freestanding binary (see build.zig), shipped on the boot volume at sbin/init,
+//! loaded by the bootloader, and started in ring 3 as a scheduled process by the
+//! kernel (system/kernel/process.zig). It links against the shared user runtime
+//! library `runtime` and talks to the kernel only through `runtime`'s system_call wrappers.
+//!
+//! Today it proves the C-convention heap works, then settles into a heartbeat:
+//! it prints a line and sleeps, forever — enough to show the system reaches user
+//! space and stays alive with a real process scheduled alongside the kernel's
+//! idle loop. It grows into the real init (service supervision) once there are
+//! other user programs to supervise.
+
+const runtime = @import("runtime");
+
+pub fn main() void {
+    // Prove the heap end to end: allocate through the runtime allocator (which
+    // mmaps pages from the kernel and carves them with the free list), write into
+    // that heap buffer (exercising the widened debug_write bounds check), and
+    // free it. A fault here would kill init before it heartbeats — so the init
+    // test doubles as the heap regression test. (C code links the same heap via
+    // the extern malloc/free symbols; Zig code uses this allocator.)
+    const gpa = runtime.allocator();
+    if (gpa.alloc(u8, 64)) |buffer| {
+        const message = "init: heap ok\n";
+        @memcpy(buffer[0..message.len], message);
+        _ = runtime.system.write(buffer[0..message.len]);
+        gpa.free(buffer);
+    } else |_| {}
+
+    while (true) {
+        _ = runtime.system.write("init: heartbeat\n");
+        runtime.system.sleep(1000);
+    }
+}
+
+pub const panic = runtime.panic;
+comptime {
+    _ = &runtime.start._start; // pull the runtime entry shim into the image
+}

system/services/vfs/protocol.zig

@@ -0,0 +1,53 @@
+//! The VFS wire protocol — the message format spoken between a client (via the
+//! `runtime` file API) and the user-space VFS server over IPC. A request is a fixed
+//! `Request` header followed by an inline payload (a path, or write bytes); a
+//! reply is a fixed `Reply` header followed by an inline payload (read bytes, or
+//! a Stat). Everything fits in one IPC message (<= ipc MESSAGE_MAXIMUM = 256 bytes).
+//!
+//! This is user-space only — the kernel knows nothing of files or paths; it only
+//! moves the bytes. Shared by library/runtime/unistd.zig (client) and system/services/vfs/vfs.zig (server).
+
+pub const Operation = enum(u32) {
+    open, // open(path) -> node id
+    close, // close(node)
+    read, // read(node, offset, len) -> bytes
+    write, // write(node, offset, bytes) -> count
+    stat, // stat(node) -> Stat
+};
+
+/// Request header. `node` is the server-side open-file id (from a prior open);
+/// for `open` the path is the payload and `len` is its length. `offset`/`len`
+/// carry the read/write position and count.
+pub const Request = extern struct {
+    operation: Operation,
+    node: u64,
+    offset: u64,
+    len: u32,
+    flags: u32,
+};
+
+/// Reply header. `status` is 0 on success or a negative errno; `node` is the new
+/// open-file id (for `open`); `len` is the payload length (bytes read, or the
+/// Stat size).
+pub const Reply = extern struct {
+    status: i32,
+    _padding: u32 = 0,
+    node: u64 = 0,
+    len: u32 = 0,
+    _padding2: u32 = 0,
+};
+
+pub const Stat = extern struct {
+    size: u64,
+    kind: u32,
+    _padding: u32 = 0,
+};
+
+pub const message_maximum: usize = 256;
+pub const request_size: usize = @sizeOf(Request);
+pub const reply_size: usize = @sizeOf(Reply);
+/// Largest inline payload that still fits one IPC message alongside a header.
+pub const maximum_payload: usize = message_maximum - request_size;
+
+/// Open flags.
+pub const O_CREAT: u32 = 1;

system/services/vfs/vfs-test.zig

@@ -0,0 +1,47 @@
+//! /sbin/vfstest — a client that proves the VFS round trip end to end: open a
+//! file through the `runtime` file API, write to it, seek back, read it, and compare.
+//! On success it heartbeats "vfstest: ok" so the kernel test can observe it;
+//! on failure it reports what went wrong. Shipped in the initrd alongside vfs.
+
+const std = @import("std");
+const runtime = @import("runtime");
+
+pub fn main() void {
+    const u = runtime.unistd;
+    const payload = "hello-vfs";
+
+    // The VFS server may not have registered yet — retry open until it's up.
+    var fd: i32 = -1;
+    var tries: u32 = 0;
+    while (fd < 0 and tries < 200) : (tries += 1) {
+        fd = u.open("greeting", u.O_CREAT);
+        if (fd < 0) runtime.system.sleep(20);
+    }
+    if (fd < 0) {
+        _ = runtime.system.write("vfstest: open failed\n");
+        return;
+    }
+
+    if (u.write(fd, payload) != @as(isize, payload.len)) {
+        _ = runtime.system.write("vfstest: write failed\n");
+        return;
+    }
+    _ = u.lseek(fd, 0, u.SEEK_SET);
+
+    var buffer: [32]u8 = undefined;
+    const n = u.read(fd, &buffer);
+    u.close(fd);
+
+    if (n == @as(isize, payload.len) and std.mem.eql(u8, buffer[0..@intCast(n)], payload)) {
+        while (true) {
+            _ = runtime.system.write("vfstest: ok\n");
+            runtime.system.sleep(1000);
+        }
+    }
+    _ = runtime.system.write("vfstest: mismatch\n");
+}
+
+pub const panic = runtime.panic;
+comptime {
+    _ = &runtime.start._start;
+}

system/services/vfs/vfs.zig

@@ -0,0 +1,140 @@
+//! /sbin/vfs — the user-space VFS server. Shipped in the initrd, spawned as a
+//! ring-3 process, and reached by every other process through IPC (the `runtime`
+//! file API marshals open/read/write/stat/close into calls to this server's
+//! endpoint, published under the well-known `vfs` service id).
+//!
+//! For now the namespace is a small in-memory ramfs (opening a name creates it):
+//! enough to prove the whole path — client file API -> IPC -> server dispatch ->
+//! reply. Device nodes backed by user-space drivers (/device) layer on top in M10,
+//! where `open` on a /device name forwards to the owning driver's endpoint.
+
+const std = @import("std");
+const runtime = @import("runtime");
+const protocol = runtime.vfs_protocol;
+
+const Node = struct {
+    used: bool = false,
+    name: [24]u8 = undefined,
+    name_len: usize = 0,
+    data: [512]u8 = undefined,
+    size: usize = 0,
+};
+
+const OpenFile = struct {
+    used: bool = false,
+    node: usize = 0,
+};
+
+var nodes = [_]Node{.{}} ** 8;
+var opens = [_]OpenFile{.{}} ** 16;
+
+fn findNode(name: []const u8) ?usize {
+    for (&nodes, 0..) |*n, i| {
+        if (n.used and std.mem.eql(u8, n.name[0..n.name_len], name)) return i;
+    }
+    return null;
+}
+
+fn createNode(name: []const u8) ?usize {
+    for (&nodes, 0..) |*n, i| {
+        if (!n.used) {
+            const l = @min(name.len, n.name.len);
+            @memcpy(n.name[0..l], name[0..l]);
+            n.* = .{ .used = true, .name = n.name, .name_len = l, .size = 0 };
+            return i;
+        }
+    }
+    return null;
+}
+
+fn openAt(id: u64) ?*OpenFile {
+    if (id >= opens.len) return null;
+    const o = &opens[@intCast(id)];
+    return if (o.used) o else null;
+}
+
+/// Serialise a reply header + payload into `out`; returns the total length.
+fn writeReply(out: []u8, reply: protocol.Reply, payload: []const u8) usize {
+    @memcpy(out[0..protocol.reply_size], std.mem.asBytes(&reply));
+    const n = @min(payload.len, out.len - protocol.reply_size);
+    @memcpy(out[protocol.reply_size..][0..n], payload[0..n]);
+    return protocol.reply_size + n;
+}
+
+fn fail(out: []u8) usize {
+    return writeReply(out, .{ .status = -1 }, &.{});
+}
+
+/// Handle one request; write the reply into `out`, return its length.
+fn handle(message: []const u8, out: []u8) usize {
+    if (message.len < protocol.request_size) return fail(out);
+    const request = std.mem.bytesToValue(protocol.Request, message[0..protocol.request_size]);
+    const payload = message[protocol.request_size..];
+
+    switch (request.operation) {
+        .open => {
+            const name = payload[0..@min(payload.len, request.len)];
+            const ni = findNode(name) orelse createNode(name) orelse return fail(out);
+            for (&opens, 0..) |*o, i| {
+                if (!o.used) {
+                    o.* = .{ .used = true, .node = ni };
+                    return writeReply(out, .{ .status = 0, .node = i }, &.{});
+                }
+            }
+            return fail(out);
+        },
+        .read => {
+            const of = openAt(request.node) orelse return fail(out);
+            const nd = &nodes[of.node];
+            const off: usize = @intCast(request.offset);
+            if (off >= nd.size) return writeReply(out, .{ .status = 0, .len = 0 }, &.{}); // EOF
+            const n = @min(@min(nd.size - off, request.len), protocol.maximum_payload);
+            return writeReply(out, .{ .status = 0, .len = @intCast(n) }, nd.data[off .. off + n]);
+        },
+        .write => {
+            const of = openAt(request.node) orelse return fail(out);
+            const nd = &nodes[of.node];
+            const off: usize = @intCast(request.offset);
+            if (off > nd.data.len) return fail(out);
+            const n = @min(@min(payload.len, request.len), nd.data.len - off);
+            @memcpy(nd.data[off .. off + n], payload[0..n]);
+            if (off + n > nd.size) nd.size = off + n;
+            return writeReply(out, .{ .status = 0, .len = @intCast(n) }, &.{});
+        },
+        .stat => {
+            const of = openAt(request.node) orelse return fail(out);
+            const st = protocol.Stat{ .size = nodes[of.node].size, .kind = 0 };
+            return writeReply(out, .{ .status = 0, .len = @sizeOf(protocol.Stat) }, std.mem.asBytes(&st));
+        },
+        .close => {
+            if (request.node < opens.len) opens[@intCast(request.node)].used = false;
+            return writeReply(out, .{ .status = 0 }, &.{});
+        },
+    }
+}
+
+pub fn main() void {
+    const endpoint = runtime.ipc.createEndpoint() orelse {
+        _ = runtime.system.write("vfs: no endpoint\n");
+        return;
+    };
+    if (!runtime.ipc.register(.vfs, endpoint)) {
+        _ = runtime.system.write("vfs: register failed\n");
+        return;
+    }
+    _ = runtime.system.write("vfs: ready\n");
+
+    var reply_buffer: [protocol.message_maximum]u8 = undefined;
+    var reply_len: usize = 0;
+    var receive: [protocol.message_maximum]u8 = undefined;
+    while (true) {
+        const got = runtime.ipc.replyWait(endpoint, reply_buffer[0..reply_len], &receive);
+        // Ignore notifications (none expected here); handle a request.
+        reply_len = handle(receive[0..got.len], &reply_buffer);
+    }
+}
+
+pub const panic = runtime.panic;
+comptime {
+    _ = &runtime.start._start;
+}