M5: rename usermode->process, add yield + mmap/munmap syscalls

Start the user-space driver track (VFS + IPC + heap). This lays the
process/syscall foundation the runtime heap will grow on.

- Rename usermode.zig -> process.zig; drop the retired hello/ping blob and
  its `user` test (subsumed by the real /sbin/init exerciser). Keep the
  isolation-proof pf blob and the user-pf test.
- Add danos.Syscall as the single source of truth for syscall numbers, shared
  by the kernel dispatcher and (later) the user runtime lib. Dispatch on the
  enum. New calls: 1=yield, 4=mmap, 5=munmap. Widen debug_write's bounds
  check to the whole user low half so heap buffers are writable.
- mmap grants zeroed RW+NX pages from a per-process bump arena
  (Task.heap_next, PML4[224] above image+stack); munmap frees the frames.
  Add paging.translateIn / unmapInto (+ arch.translate / unmapUserPageInto)
  as the primitives munmap and future cross-AS copies need.
- New `usermem` test: grant three pages into a fresh AS, translate them,
  release via the munmap path, tear down, and assert no frames leak.
  Suite 28/28 (user -> usermem).

docs/syscall.md

@@ -6,7 +6,7 @@ System calls (syscalls) are the bridge between your programs and the operating s
 > `isr.s` does the `swapgs` + kernel-stack switch and reuses the interrupt
 > dispatcher). The `int 0x80` gate is kept alongside as a minimal test path. The
 > current call set is still a placeholder — `0 = exit(code)`, `1 = ping`,
-> `2 = write(ptr, len)`, `3 = sleep(ms)` (see `src/kernel/usermode.zig`); the
+> `2 = write(ptr, len)`, `3 = sleep(ms)` (see `src/kernel/process.zig`); the
 > handler dispatches on whether the caller is a scheduled process (its own address
 > space) or a borrowed test thread. The microkernel set below (IPC_Call /
 > IPC_ReplyWait / Yield) replaces it once a second user server exists.