protocols: attach gets its reverse — block detach, usb-transfer dma_detach

The kernel was always symmetric (dma_bind 51 / dma_unbind 52); the two
protocols that forward an attachment up the stack were one-way, so a live
client could grant a device reach into its buffer but never revoke it while
alive — exactly the one-way lifecycle the storage architecture's enforcement
section forbids. Death stays the mechanical backstop; detach is the living
process's path.

Both verbs are appended, so every existing number holds. The shape mirrors
attach precisely: the same region capability rides the cap slot again — the
kernel matches the region, so no layer retains anything between the calls
(the bus never kept the handle; now it never needs to).

fat's bring-up does attach -> detach -> attach, exercising both verbs
through the whole chain (fat -> storage -> bus -> kernel) on every boot: a
broken detach fails every fat case instead of lying dormant until the first
buffer replacement. Honest scope: the round trip proves the plumbing; unbind
semantics are the kernel iommu tests' (map/unmap/translationOf); the full
composition (detach then DMA faults) is a future iommu-fault extension.

system/services/fat/fat.zig

@@ -196,10 +196,22 @@ fn tryBringUp() void {
     // enforcing IOMMU. No-op binding otherwise.
     const bounce = memory.dmaAlloc(engine.max_transfer_sectors * 512, memory.dma_coherent | memory.dma_shareable) orelse return;
     if (bounce.handle) |handle| {
+        // Attach, detach, and attach again: the round trip exercises BOTH verbs
+        // of the DMA-window lifecycle through the whole chain (fat → storage →
+        // bus → kernel) on every boot, so a broken detach fails every fat case
+        // rather than lying dormant until the first buffer replacement.
         if (!device.attach(handle)) {
             _ = logging.write("/system/services/fat: could not attach the DMA bounce buffer\n");
             return;
         }
+        if (!device.detach(handle)) {
+            _ = logging.write("/system/services/fat: could not detach the DMA bounce buffer\n");
+            return;
+        }
+        if (!device.attach(handle)) {
+            _ = logging.write("/system/services/fat: could not re-attach the DMA bounce buffer\n");
+            return;
+        }
         _ = ipc.close(handle); // the binding holds its own reference now
     }
     ipc_block = .{ .device = device, .bounce = bounce };