Update stale /sbin/ references to real FHS paths

The reorg moved user binaries under /system (init -> /system/services/init,
drivers -> /system/drivers/<name>, vfs-test -> /system/services/vfs/vfs-test), but
many comments and log strings still named the old /sbin/ home. Retarget them all:
kernel/loader/test comments and the two boot log lines, plus vision.md and the
driver-model.md proposed tree (also dropped the stale `d` suffixes and rt->runtime
there). The initial-ramdisk spawn log no longer fakes a /sbin/ prefix, since those
binaries live in different homes (services vs drivers).

Left the FSH design doc's /sbin and /lib rows alone — whether /sbin stays a
directory at all is a design call for its owner, not a stale-comment fix.

docs/driver-model.md

@@ -99,21 +99,21 @@ danos already has one of each: `library/runtime/device.zig` is a logic module,
 and its clients. The pattern generalises directly:
 
 ```
-lib/
-  rt.zig            module "rt"     — syscalls, heap, ipc, dev, stdio
-  mmio.zig          module "mmio"   — volatile register access + barriers   [M14]
+library/
+  runtime/          module "runtime" — syscalls, heap, ipc, device, stdio
+  mmio/             module "mmio"    — volatile register access + barriers   [M14]
   bus/
-    pci.zig         module "pci"    — ECAM, BAR decode, capability walk
-    usb.zig         module "usb"    — descriptors, control transfers, hubs
+    pci/            module "pci"     — ECAM, BAR decode, capability walk
+    usb/            module "usb"     — descriptors, control transfers, hubs
   proto/
-    vfs.zig         module "proto.vfs"    (today: system/services/vfs/protocol.zig)
-    block.zig       module "proto.block"
-    hid.zig         module "proto.hid"
+    vfs/            module "vfs-protocol"  (today: system/services/vfs/protocol.zig)
+    block/          module "block-protocol"
+    hid/            module "hid-protocol"
 
-sbin/
-  xhcid.zig     HCD + bus driver    imports rt, pci, usb, mmio
-  usbhid.zig    class driver        imports rt, usb, proto.hid
-  blockd.zig    class driver        imports rt, proto.block
+system/drivers/     one sub-project each → /system/drivers (no `d` suffix)
+  xhci/       HCD + bus driver    imports runtime, pci, usb, mmio
+  usb-hid/    class driver        imports runtime, usb, hid-protocol
+  block/      class driver        imports runtime, block-protocol
 ```
 
 The only build change needed: [`addUserBinary`](build.zig) currently takes exactly one

docs/vision.md

@@ -84,13 +84,13 @@ interrupts](interrupts.md), a [calibrated timer + ns clock](device-interrupts.md
 in-kernel [IPC channels](ipc.md), SMP (all cores scheduling, with affinity), a
 **higher-half kernel** with a physmap, and **user space**: per-process address
 spaces, `syscall`/`sysret` with the `swapgs` discipline, a user-ELF loader, and
-`/sbin/init` — a real user ELF built from `sbin/`, running at CPL 3 as PID 1 on its
+`/system/services/init` — a real user ELF built from `system/services/init/`, running at CPL 3 as PID 1 on its
 own page tables — plus a [test harness](testing.md).
 
 - **Isolation track** — **user mode + address-space isolation**. *Done: a
   higher-half kernel with a physmap (the low half is user space), per-process
   address spaces with CR3 switched on context switch, the `swapgs` discipline,
-  `syscall`/`sysret`, a user-ELF loader, and `/sbin/init` running as a real
+  `syscall`/`sysret`, a user-ELF loader, and `/system/services/init` running as a real
   preemptive ring-3 process (PID 1). Remaining polish: an address-space/stack
   reaper for exited tasks, SMAP + fault-recovering copy-in/out, the real IPC
   syscalls (IPC_Call/IPC_ReplyWait — they arrive with the second user server),