kernel: user memory is reached only through a checked copy

A new user-memory module owns every kernel touch of a user buffer:
copyFromUser, the new copyToUser, and the resolve behind both. The walk
accumulates the U/S and writable bits down all four levels with the MMU's
own AND rule — folding a 2 MiB leaf in before it resolves and refusing a
1 GiB leaf outright — so a copy honours what ring 3 itself would be
allowed, closing the presence-only trust model the IPC layer carried since
bring-up. It then confirms the frame is physmap-backed, because that is how
the copy reaches it: an mmio_map'd BAR passes the permission walk and would
otherwise fault ring 0 on an alias the physmap never mapped, on the IPC path
as much as the new one.

The nine stragglers that dereferenced user pointers raw now route through
it, so a bad pointer returns -EFAULT where it used to fault the kernel.
The write direction restructures its callees around kernel bounce buffers:
scheduler and devices-broker enumerate from a slot cursor (a task exiting
between chunks can neither duplicate nor lose an entry), klog_read drains
the ring in chunks, and fs_node stages headers and names contiguously.
fs_resolve copies out before installing the endpoint handle, so a faulting
copy cannot strand a capability; its out-capacity bound no longer adds an
unbounded ring-3 length to the base, which wrapped and trapped the kernel's
own overflow check. debug_write reads the caller's message once.

Suite 107/107 (new user-memory case: seven bad pointers refused, each
paired with a sound call that must still succeed).

test/qemu_test.py

@@ -343,6 +343,16 @@ CASES = [
     {"name": "usermem",
      "expect": r"DANOS-TEST-RESULT: PASS",
      "fail":   r"DANOS-TEST-RESULT: FAIL"},
+    # The checked copy layer (system/kernel/user-memory.zig): kernel-side unit
+    # checks for the bound, presence, and leaf U/S + writable refusals, then a
+    # fixture aiming unmapped-but-in-range pointers at klog_read/klog_status/
+    # process_enumerate/device_enumerate/fs_resolve/debug_write. Each must come
+    # back as a wrapped -errno with the machine still running — before H1 every
+    # one of them dereferenced the bad page in ring 0 and halted it.
+    {"name": "user-memory",
+     "timeout": 60,
+     "expect": r"(?s)(?=.*DANOS-TEST-RESULT: PASS)(?=.*user-memory-test: ok)",
+     "fail":   r"user-memory-test: FAIL|DANOS-TEST-RESULT: FAIL|CPU EXCEPTION|KERNEL PANIC"},
     # Isolation: a ring-3 read of a kernel-only page must #PF with error code
     # 0x5 (present|user) at the user IP. ([\s\S] spans lines; `.` doesn't.)
     {"name": "user-pf",