Device manager (increment 2): system_spawn — actually start the driver

Add a `system_spawn(name)` system call: the kernel loads a binary bundled in the
initial-ramdisk, by name, as a fresh ring-3 process. It's the mechanism a user-space
supervisor needs — discovery and policy stay in user space, the kernel only spawns.
The kernel already holds the initial-ramdisk image from the boot handoff; it now
stashes it (process.setInitialRamdisk) so the handler can resolve names, bounds-checks
the name into the user half like debug_write, and returns -1 for an unknown name or a
load failure. Ungated for now (any process may spawn any bundled binary); a spawn
capability belongs here once the model grows one.

The device manager stops logging "would spawn it" and calls runtime.system.spawn on
its matched driver. On QEMU it discovers the HPET, matches `hpet`, and spawns it — and
the driver comes all the way up (claims the timer, maps its MMIO, binds and services
its IRQ, prints "hpet: ok"). The device-manager test now keys on that final marker:
since only the manager is spawned, `hpet: ok` appearing proves the whole
discover -> match -> system_spawn -> driver-up chain end to end.

Transitional: the kernel still auto-spawns the whole initial-ramdisk at boot, so a
real boot briefly double-spawns hpet (the second claim fails harmlessly). Increment 3
removes that redundancy so the manager is the sole owner of driver spawning. Suite
36/36 plus host tests.

system/kernel/tests.zig

@@ -1196,11 +1196,21 @@ fn deviceManagerTest(boot_information: *const BootInformation) void {
         return;
     };
 
+    // Let `system_spawn` find bundled binaries by name (the normal boot path does
+    // this too). Only the device-manager is spawned here — so if `hpet` runs at all,
+    // it's because the manager discovered the timer, matched, and spawned it.
+    process.setInitialRamdisk(image);
+
     process.write_count = 0;
     process.write_from_user = false;
     check("device-manager spawned from the initial_ramdisk", spawnNamed(rd, "device-manager"));
 
-    const prefix = "device-manager: ok";
+    // End-to-end proof: the driver the manager spawned reaches its own live marker.
+    // `hpet: ok` is hpet's final, stable message (it claims the timer, maps its MMIO,
+    // binds its IRQ, services one, then sleeps) — nothing overwrites the buffer after,
+    // so it's race-free to poll for. Its arrival means the whole
+    // discover -> match -> system_spawn -> driver-up chain worked.
+    const prefix = "hpet: ok";
     scheduler.setPriority(1);
     const deadline = architecture.millis() + 10000;
     while (architecture.millis() < deadline) {
@@ -1210,7 +1220,7 @@ fn deviceManagerTest(boot_information: *const BootInformation) void {
     scheduler.setPriority(4);
 
     const ok = process.write_len >= prefix.len and eql(process.write_buffer[0..prefix.len], prefix);
-    check("device manager enumerated the tree and matched a driver to a device", ok);
+    check("device manager matched the timer and system_spawn'd hpet, which came up", ok);
     check("its syscalls came from user mode (CPL 3)", process.write_from_user);
     result();
 }