Re-organize the source tree as a monorepo mirroring the FHS

The source layout now mirrors the runtime filesystem hierarchy
(docs/danos-file-system-hierarchy-FSH.md): what lives under system/ in the
source is what a running danos represents under /system. Each service and
driver is a sub-project directory that is its own Zig module — cross-project
references go by module name, never by a path into another project's files.

Moves (all git mv, history preserved):
- src/            -> system/            (danos internals; the self-representation)
    root.zig      -> danos.zig          (the kernel<->user contract module)
    kernel/arch/  -> kernel/architecture/   (arch -> architecture)
    device/       -> devices/           (what /system/devices reflects)
    boot/         -> /boot              (the loaders, top level)
- sbin/           -> split by role:
    init, vfs     -> system/services/<name>/<name>.zig
    hpetd, busd   -> system/drivers/<name>/<name>.zig
    vfs-test      -> system/services/vfs/vfs-test.zig  (inside the vfs project)
- lib/            -> library/runtime/   (room for other libraries beside runtime)

The VFS wire protocol becomes its own module, system/services/vfs/protocol.zig
("vfs-protocol"): the vfs sub-project exposes its interface, and the runtime's
file layer imports it by name. First instance of the "protocol module" pattern
(docs/driver-model.md); usb/block will expose theirs the same way.

Also: fix a naming-standard violation in the protocol — Op -> Operation (and
req -> request, _pad -> _padding). Docs updated: /system/services added to the
FHS doc, a repository-layout section added to the docs index, and stale source
paths swept across comments and docs.

Runtime boot paths are unchanged (the bootloader still loads /sbin/init);
aligning the runtime filesystem to the FHS is a separate follow-up. Suite 35/35
plus host tests green.

system/services/vfs/vfs-test.zig

@@ -0,0 +1,47 @@
+//! /sbin/vfstest — a client that proves the VFS round trip end to end: open a
+//! file through the `runtime` file API, write to it, seek back, read it, and compare.
+//! On success it heartbeats "vfstest: ok" so the kernel test can observe it;
+//! on failure it reports what went wrong. Shipped in the initrd alongside vfs.
+
+const std = @import("std");
+const runtime = @import("runtime");
+
+pub fn main() void {
+    const u = runtime.unistd;
+    const payload = "hello-vfs";
+
+    // The VFS server may not have registered yet — retry open until it's up.
+    var fd: i32 = -1;
+    var tries: u32 = 0;
+    while (fd < 0 and tries < 200) : (tries += 1) {
+        fd = u.open("greeting", u.O_CREAT);
+        if (fd < 0) runtime.system.sleep(20);
+    }
+    if (fd < 0) {
+        _ = runtime.system.write("vfstest: open failed\n");
+        return;
+    }
+
+    if (u.write(fd, payload) != @as(isize, payload.len)) {
+        _ = runtime.system.write("vfstest: write failed\n");
+        return;
+    }
+    _ = u.lseek(fd, 0, u.SEEK_SET);
+
+    var buffer: [32]u8 = undefined;
+    const n = u.read(fd, &buffer);
+    u.close(fd);
+
+    if (n == @as(isize, payload.len) and std.mem.eql(u8, buffer[0..@intCast(n)], payload)) {
+        while (true) {
+            _ = runtime.system.write("vfstest: ok\n");
+            runtime.system.sleep(1000);
+        }
+    }
+    _ = runtime.system.write("vfstest: mismatch\n");
+}
+
+pub const panic = runtime.panic;
+comptime {
+    _ = &runtime.start._start;
+}