Split the system contract into boot-handoff / abi / device-abi

The `system` module (formerly `danos`) had become a grab-bag: it held the
loader<->kernel handoff *and* the kernel<->user ABI *and* the device wire types, in
one module three different audiences imported. Usage proved the seam — the
bootloader never touched the syscall/device ABI, and user space never touched the
boot handoff — so split it by audience, one module per contract:

  system/boot-handoff.zig       loader <-> kernel: BootInformation, Framebuffer,
                                MemoryMap, the VM layout + physicalToVirtual, kernel_abi
  system/abi.zig                kernel <-> user, core: SystemCall, mmap prot flags,
                                page_size, notify_badge_bit, ServiceId
  system/devices/device-abi.zig kernel <-> user, devices: DeviceDescriptor,
                                DeviceClass, ResourceDescriptor, ResourceKind, ...

device-abi is the devices sub-project's public interface, exposed as its own module
the way vfs exposes vfs-protocol — importable by user space, unlike the
kernel-internal device model it also feeds. That collapses a real duplication:
DeviceClass and ResourceKind were defined twice (device-model.zig and the contract,
kept "in sync by hand"); device-model now re-exports them from device-abi, so the
enum a driver matches on and the one the kernel classifies with are one type.

Each import now declares which contract it speaks: the bootloader imports only
boot-handoff; a driver only abi + device-abi (via the runtime); the kernel all
three. This also retires the `system` / `runtime.system` name overlap. page_size
lands in abi (it's part of the mmap contract user space aligns to); the bootloader
keeps its own local 4 KiB constant so it depends on nothing but the handoff.

All 21 importers rewired, docs updated to keep /system mapping to source. Build,
host tests, and the QEMU suite (36/36) all green.

docs/efi.md

@@ -124,7 +124,7 @@ entirely ours.
 ### 4. Jump to the kernel
 
 ```zig
-const kernel: *const fn (*const BootInfo) callconv(system.kernel_abi) noreturn =
+const kernel: *const fn (*const BootInfo) callconv(boot_handoff.kernel_abi) noreturn =
     @ptrFromInt(entry);
 kernel(&boot_info);
 ```
@@ -142,17 +142,19 @@ kernel is freestanding and uses the **SysV AMD64** convention (first argument in
 read garbage.
 
 So both sides pin the convention explicitly to SysV via the shared
-`system.kernel_abi` (defined in `system/system.zig`). The loader's function-pointer type
-and the kernel's `_start` both reference it, so the pointer lands in the register
-the kernel expects. This is the whole reason `kernel_abi` lives in the shared
-`system` module: it's a contract both binaries must agree on. See
+`boot_handoff.kernel_abi` (defined in `system/boot-handoff.zig`). The loader's
+function-pointer type and the kernel's `_start` both reference it, so the pointer lands
+in the register the kernel expects. This is the whole reason `kernel_abi` lives in the
+shared `boot-handoff` module: it's a contract both binaries must agree on. See
 [sysv.md](sysv.md) for what "SysV" means and where else it shows up.
 
 ## The handoff contract
 
 The loader and kernel are two *separate* binaries built for two different targets,
 so everything they exchange must have an identically-defined memory layout. That's
-what `system/system.zig` provides — imported by both as the `system` module:
+what `system/boot-handoff.zig` provides — imported by both as the `boot-handoff` module.
+It is *only* the handoff: the kernel↔user ABI (`system/abi.zig`) and the device types
+(`system/devices/device-abi.zig`) are separate contracts the bootloader never sees.
 
 - `BootInfo` — the top-level struct passed to the kernel (currently just the
   framebuffer; this is where future handoff data like the memory map will go).