pci: full driver-side library (MSI/MSI-X, power, FLR, extended caps); xhci goes interrupt-driven

library/device/pci is now the complete generic floor a leaf PCI driver
needs, instead of just what virtio-gpu used:

- pci-class: capability IDs, MSI/MSI-X/power-management/PCI-Express
  register layouts, extended-capability header decode (host-tested),
  per-bit command constants, remaining header offsets.
- pci.Function: header accessors, disableBusMaster + interrupt-disable
  helpers, findCapability, programMsi/disableMsi, MsiX vector-table
  struct, ensurePowerStateD0, functionLevelReset (BAR save/restore),
  extended-capability iterator.

Proven by the new pci-caps QEMU case: a pci-cap-test fixture claims an
extra e1000e (PM+MSI+PCIe+MSI-X, no danos driver) and readback-verifies
every surface, including the first driver-side use of msi_bind.

usb-xhci-bus converts from 8 ms event-ring polling to message-signalled
interrupts: plain MSI where offered (real Intel xHC), MSI-X entry 0
otherwise (qemu-xhci has no MSI capability), byte-identical polling as
fallback. The timer survives as a 250 ms port-reconcile/lost-edge tick —
real-hardware USB2 hub debounce still needs it. MSI setup runs BEFORE
controller bring-up: QEMU's xhci only registers the MSI-X vector as used
when IMAN.IE is written while MSI-X is already enabled; interrupts are
silently dropped otherwise (real hardware does not care about the order).

101/101 QEMU cases green; real-hardware smoke passed (mouse works,
boot 2026-07-23T174805Z, plain-MSI branch, vector 33).

system/kernel/tests.zig

@@ -212,6 +212,8 @@ pub fn run(case: []const u8, boot_information: *const BootInformation) void {
         deviceListTest(boot_information);
     } else if (eql(case, "pci-scan")) {
         pciScanTest(boot_information);
+    } else if (eql(case, "pci-caps")) {
+        pciCapsTest(boot_information);
     } else if (eql(case, "acpi-parse")) {
         acpiParseTest(boot_information);
     } else if (eql(case, "acpi-report")) {
@@ -2388,6 +2390,41 @@ fn deviceListTest(boot_information: *const BootInformation) void {
     result();
 }
 
+/// The driver-side PCI library against a real function: the pci-caps QEMU case adds an
+/// e1000e NIC no danos driver claims; the pci-cap-test fixture claims it and exercises
+/// header accessors, command bits, the capability walks, MSI programming (the first
+/// driver-side `msi_bind` use), the MSI-X table, power state, and FLR. The kernel side
+/// only spawns the manager (which spawns pci-bus itself) and the fixture; the substance
+/// is asserted by the harness on the fixture's own serial lines.
+fn pciCapsTest(boot_information: *const BootInformation) void {
+    log("DANOS-TEST-BEGIN: pci-caps\n", .{});
+    if (boot_information.initial_ramdisk_len == 0) {
+        check("bootloader handed over an initial_ramdisk", false);
+        result();
+        return;
+    }
+    const image = @as([*]const u8, @ptrFromInt(boot_handoff.physicalToVirtual(boot_information.initial_ramdisk_base)))[0..boot_information.initial_ramdisk_len];
+    const rd = initial_ramdisk.Reader.init(image) orelse {
+        check("initial_ramdisk image is valid", false);
+        result();
+        return;
+    };
+
+    process.setInitialRamdisk(image);
+    // Plain mode — no restart drill, whose kill would race the fixture's claim.
+    var manager: u32 = 0;
+    var i: u32 = 0;
+    while (i < rd.count) : (i += 1) {
+        const item = rd.entry(i) orelse continue;
+        if (!eql(initial_ramdisk.basename(item.name), "device-manager")) continue;
+        manager = process.spawnProcessSupervised(item.blob, 4, &.{"device-manager"}, scheduler.currentId(), null) catch 0;
+        break;
+    }
+    check("device-manager spawned", manager != 0);
+    check("pci-cap-test spawned", spawnNamed(rd, "pci-cap-test"));
+    result();
+}
+
 /// M19.1: the ring-3 PCI scan agrees with the kernel's. The manager spawns
 /// pci-bus for the host bridge; the driver walks the same ECAM window through
 /// its mmio_map grant and must find exactly the functions the kernel's own