M2 step 5: drop the low half — a true higher-half kernel

paging.init now maps only the physmap, the framebuffer/LAPIC windows,
and the kernel's own segments; the entire low canonical half is left to
user space. Every higher-half PML4 entry is pre-created so a per-process
address space can share the kernel half by copying PML4[256..512), with
an assert against late top-half entries and a 4 GiB guard on
pre-switch table frames. The AP trampoline's low identity page is now
created transiently by arm() and unmapped by disarm(); startAp asserts
the page-table root is 32-bit addressable. Docs (paging.md) updated.
Suite 27/27; 4-core normal boot reaches /sbin/init.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

src/kernel/tests.zig

@@ -144,7 +144,7 @@ fn smoke(boot_info: *const BootInfo) void {
 
     // The memory map has some usable RAM.
     const mm = boot_info.memory_map;
-    const regions = @as([*]const danos.MemoryRegion, @ptrFromInt(mm.regions))[0..mm.len];
+    const regions = @as([*]const danos.MemoryRegion, @ptrFromInt(danos.physToVirt(mm.regions)))[0..mm.len];
     var usable: u64 = 0;
     for (regions) |r| {
         if (r.kind == .usable) usable += r.pages;