M9: user-space VFS server + client file API (open/read/write/stat + stdio)

The payoff milestone: files are served by a user-space process, reached over
IPC — the kernel never sees a path or an fd.

- lib/vfs_proto.zig: the VFS wire protocol (Op, Request/Reply fixed header +
  inline payload, Stat), shared by client and server; one message <= MSG_MAX.
- lib/ipc.zig: replyWait() — the server-side dual-return stub (length in rax,
  badge in rdx via a "+{rdx}" read-write operand), deferred from M7.
- sbin/vfs.zig: the real VFS server — an in-heap ramfs (open creates a node)
  with an IPC_ReplyWait dispatch loop serving open/read/write/stat/close.
  Registers its endpoint under the well-known vfs id at startup.
- lib/unistd.zig: POSIX-style client API in rt — a per-process fd table +
  open/close/read/write/lseek/stat, each an IPC_Call to the VFS. The kernel
  knows nothing of fds; the table lives here.
- lib/stdio.zig: C stdio over unistd — FILE + fopen/fclose/fread/fwrite/
  fseek/ftell/rewind/feof/ferror/fputs/fputc/fgetc (unbuffered for now).
- sbin/vfstest.zig: a client that opens/writes/seeks/reads a file and only
  heartbeats "vfstest: ok" if the round trip matched. Packed in the initrd.
- New `vfs` test drives it end to end. initrd test relaxed to generic
  liveness. Suite 31/31.

lib/ipc.zig

@@ -50,5 +50,29 @@ pub fn call(h: Handle, msg: []const u8, reply: []u8) CallError!usize {
     return if (failed(r)) error.Failed else r;
 }
 
-// replyWait() (server side — returns message length + sender badge) lands with
-// the first server binary (M9), where it can be exercised end to end.
+/// The result of a `replyWait`: the request length and the sender's badge (a
+/// task id, or an IRQ notification if the high bit is set).
+pub const Received = struct {
+    len: usize,
+    badge: u64,
+};
+
+/// Server side of IPC_ReplyWait: deliver `reply` to the client last received (if
+/// any), then block until the next request arrives in `recv`. Returns its length
+/// and the sender badge. This syscall returns two values — the length in rax and
+/// the badge in rdx — so it needs a hand-written stub: rdx is a read-write
+/// operand (input = reply length, arg #3; output = badge).
+pub fn replyWait(h: Handle, reply: []const u8, recv: []u8) Received {
+    var rax: usize = undefined;
+    var rdx: usize = reply.len; // in: reply_len (arg #3 -> rdx); out: badge
+    asm volatile ("syscall"
+        : [rax] "={rax}" (rax),
+          [rdx] "+{rdx}" (rdx),
+        : [n] "{rax}" (@intFromEnum(danos.Syscall.ipc_reply_wait)),
+          [a0] "{rdi}" (h),
+          [a1] "{rsi}" (@intFromPtr(reply.ptr)),
+          [a3] "{r10}" (@intFromPtr(recv.ptr)),
+          [a4] "{r8}" (recv.len),
+        : .{ .rcx = true, .r11 = true, .memory = true });
+    return .{ .len = rax, .badge = rdx };
+}