kernel: claim refuses delegated hardware — and E2 had already closed the hole

The rule as planned: a device that was given to someone may be handed on,
never taken. Implemented, and honest about what it is worth.

Writing the test showed the plan had the wrong step doing the work. A
delegated device is HELD, so an attempt to take it is refused as
AlreadyClaimed before the giver is ever consulted; and once a borrower's
death returns the device to its lender — or clears both when the lender is
gone — there is no state where a device is unheld and still on loan. The
window a stranger could have used stops existing at E2. This check is
unreachable.

It stays anyway: one comparison, failing closed, guarding any future path
that frees a device without clearing its giver, which is exactly the hole
this run closed. The comment says it is unreachable rather than implying a
protection it does not provide.

The attacker fixture does not gain the assertion that was deferred to this
step, and its header records why: there is no refusal for it to observe, and
on a bare boot with no device manager nothing is delegated at all, so the
assertion had nothing to bite on. It failed loudly on its first run rather
than passing quietly, which is the only reason this was noticed.

It also leaves the loader's framebuffer alone without naming it: nobody
delegates the framebuffer, so it has no giver, so the display service claims
it exactly as before.

Suite 118/118.

library/device/driver/driver.zig

@@ -70,7 +70,7 @@ pub fn transfer(id: u64, to: u32) TransferError!void {
 /// re-enumerate, and `NotConfined` means the machine could not place the device under
 /// IOMMU translation — the claim was rolled back, and that one is a fault report, not
 /// a retry. `Refused` is an errno this library does not know a name for.
-pub const ClaimError = error{ NoSuchDevice, AlreadyClaimed, NotConfined, Refused };
+pub const ClaimError = error{ NoSuchDevice, AlreadyClaimed, NotConfined, NotYours, Refused };
 
 /// Take exclusive ownership of device `id`.
 pub fn claim(id: u64) ClaimError!void {
@@ -80,6 +80,7 @@ pub fn claim(id: u64) ClaimError!void {
         abi.ENODEV => error.NoSuchDevice,
         abi.EBUSY => error.AlreadyClaimed,
         abi.ECONFINE => error.NotConfined,
+        abi.EPERM => error.NotYours, // delegated hardware: it must be handed to you
         else => error.Refused,
     };
 }