kernel: shm cross-process shared memory capability (v2 V2)

Generalize capability passing from endpoints to memory objects. The per-task
handle table now holds kind-tagged entries (scheduler.HandleObject{kind, ptr});
closeHandles and shareCapability dispatch by kind, so a shared-memory object
rides an ipc_call send_cap exactly like an endpoint and is refcount-freed only
when its last capability drops.

- shm_create(len) -> vaddr, handle: contiguous, zeroed, cacheable frames wrapped
  in a refcounted ShmObject, mapped into the caller's shm arena (PML4[230]).
- shm_map(cap) -> vaddr: map the same physical pages into a receiver that got the
  capability. mapUserSharedInto maps WB-cacheable + device_grant, so a sharer's
  teardown never frees the shared frames — the object owns them.
- runtime.shm: create(len) -> Region{ptr, handle, len}, map(handle) -> ptr.

Gate: qemu_test.py shm — shm-client creates a region, writes a pattern, passes
its capability to shm-server, which maps it and reads the same bytes back
(shm: shared 4096 bytes ok). ipc/ipc-call/ipc-cap/supervision/dma/usermem/
display-service and host tests all still pass — the handle change broke no IPC.

docs/display-v2-plan.md

@@ -57,19 +57,27 @@ Extract scanout from the compositor so today's path becomes one backend among fu
 **Gate (met):** `display-service` + `display-demo` pass **unchanged** (pure refactor; GOP
 is the only backend), and `zig build test` stays green.
 
-## V2 — The `shm` cross-process memory capability (kernel)
+## V2 — The `shm` cross-process memory capability (kernel) ✅
 
-- [ ] [abi.zig](../system/abi.zig): `shm_create`, `shm_map` syscalls (+ a `ServiceId`/cap
-      convention if needed). Kernel handlers: `shm_create(len)` allocates page-aligned RAM,
-      returns a handle + maps it; passing the handle as an `ipc_call` `send_cap` shares it;
-      `shm_map(cap)` maps the same physical pages into the receiver. Reclaimed on death.
-- [ ] `library/runtime/shm.zig` (+ barrel export): `create(len) -> Region{handle, ptr}`,
-      `map(cap) -> ptr`.
-- [ ] Reuse the M13 capability-passing machinery (endpoints → memory objects).
+- [x] [abi.zig](../system/abi.zig): `shm_create` (34) / `shm_map` (35) syscalls + a
+      `shm_test` service id. Handlers in process.zig: `shm_create(len)` allocates contiguous,
+      zeroed, **cacheable** frames, wraps them in a refcounted object, installs a capability
+      handle, maps them into the caller's shm arena → returns vaddr + handle; `shm_map(cap)`
+      maps the same physical pages into the receiver. Reclaimed on death (see below).
+- [x] The capability core (ipc-synchronous.zig) is now **kind-tagged**: `scheduler.Task`'s
+      handle table holds `HandleObject{kind, ptr}`; `closeHandles` and `shareCapability`
+      dispatch by kind, so an `ShmObject` rides an `ipc_call` `send_cap` exactly like an
+      endpoint and frees only when its last capability drops. `mapUserSharedInto` (paging)
+      maps WB-cacheable + `device_grant`, so a sharer's teardown never frees the shared
+      frames — the object owns them.
+- [x] `library/runtime/shm.zig` (+ barrel export): `create(len) -> Region{ptr, handle, len}`,
+      `map(handle) -> ptr`.
 
-**Gate:** a kernel/qemu `shm` test — process A `shm_create`s a region, writes a pattern,
-passes the cap to process B, which `shm_map`s it and reads the same bytes back (proving
-shared physical pages, not a copy). Heartbeat `shm: shared N bytes ok`.
+**Gate (met):** `python3 test/qemu_test.py shm` — `shm-client` creates a region, writes a
+pattern, and passes its capability to `shm-server` as an `ipc_call` send_cap; the server
+`shm_map`s it and reads the **same bytes** back → `shm: shared 4096 bytes ok`. Guardrail:
+`ipc`/`ipc-call`/`ipc-cap`, `supervision`, `dma`, `usermem`, `display-service`, and host
+tests all still pass — the handle-table change broke no existing IPC.
 
 ## V3 — The virtio-gpu driver: bring-up + a frame on screen