M5: rename usermode->process, add yield + mmap/munmap syscalls

Start the user-space driver track (VFS + IPC + heap). This lays the
process/syscall foundation the runtime heap will grow on.

- Rename usermode.zig -> process.zig; drop the retired hello/ping blob and
  its `user` test (subsumed by the real /sbin/init exerciser). Keep the
  isolation-proof pf blob and the user-pf test.
- Add danos.Syscall as the single source of truth for syscall numbers, shared
  by the kernel dispatcher and (later) the user runtime lib. Dispatch on the
  enum. New calls: 1=yield, 4=mmap, 5=munmap. Widen debug_write's bounds
  check to the whole user low half so heap buffers are writable.
- mmap grants zeroed RW+NX pages from a per-process bump arena
  (Task.heap_next, PML4[224] above image+stack); munmap frees the frames.
  Add paging.translateIn / unmapInto (+ arch.translate / unmapUserPageInto)
  as the primitives munmap and future cross-AS copies need.
- New `usermem` test: grant three pages into a fresh AS, translate them,
  release via the munmap path, tear down, and assert no frames leak.
  Suite 28/28 (user -> usermem).

build.zig

@@ -152,7 +152,7 @@ pub fn build(b: *std.Build) void {
 
     // --- /sbin/init: the first user-space program ---
     // Its own tiny freestanding binary, linked at a fixed address inside the
-    // kernel's user region (usermode.zig) and started in ring 3 by the kernel's
+    // kernel's user region (process.zig) and started in ring 3 by the kernel's
     // user-ELF loader. `.large` because the image base is above 4 GiB — small/
     // medium code models emit 32-bit absolute relocations that can't reach.
     // Pinned to ReleaseSmall: the user region gives it a 2 MiB budget and its