Split the system contract into boot-handoff / abi / device-abi

The `system` module (formerly `danos`) had become a grab-bag: it held the
loader<->kernel handoff *and* the kernel<->user ABI *and* the device wire types, in
one module three different audiences imported. Usage proved the seam — the
bootloader never touched the syscall/device ABI, and user space never touched the
boot handoff — so split it by audience, one module per contract:

  system/boot-handoff.zig       loader <-> kernel: BootInformation, Framebuffer,
                                MemoryMap, the VM layout + physicalToVirtual, kernel_abi
  system/abi.zig                kernel <-> user, core: SystemCall, mmap prot flags,
                                page_size, notify_badge_bit, ServiceId
  system/devices/device-abi.zig kernel <-> user, devices: DeviceDescriptor,
                                DeviceClass, ResourceDescriptor, ResourceKind, ...

device-abi is the devices sub-project's public interface, exposed as its own module
the way vfs exposes vfs-protocol — importable by user space, unlike the
kernel-internal device model it also feeds. That collapses a real duplication:
DeviceClass and ResourceKind were defined twice (device-model.zig and the contract,
kept "in sync by hand"); device-model now re-exports them from device-abi, so the
enum a driver matches on and the one the kernel classifies with are one type.

Each import now declares which contract it speaks: the bootloader imports only
boot-handoff; a driver only abi + device-abi (via the runtime); the kernel all
three. This also retires the `system` / `runtime.system` name overlap. page_size
lands in abi (it's part of the mmap contract user space aligns to); the bootloader
keeps its own local 4 KiB constant so it depends on nothing but the handoff.

All 21 importers rewired, docs updated to keep /system mapping to source. Build,
host tests, and the QEMU suite (36/36) all green.

system/kernel/architecture/x86_64/paging.zig

@@ -10,10 +10,11 @@
 //! Everything is 4 KiB pages — precise and simple; the extra table memory is
 //! negligible against available RAM.
 
-const system = @import("system");
+const boot_handoff = @import("boot-handoff");
+const abi = @import("abi");
 const io = @import("io.zig");
 
-const page_size = system.page_size;
+const page_size = abi.page_size;
 
 // Page-table entry bits.
 const present: u64 = 1 << 0;
@@ -58,7 +59,7 @@ const bootstrap_physmap_limit: u64 = 4 << 30;
 /// both the loader's bootstrap tables and the kernel's own, which share the
 /// physmap base.
 fn tableAt(physical: u64) *[512]u64 {
-    return @ptrFromInt(system.physicalToVirtual(physical));
+    return @ptrFromInt(boot_handoff.physicalToVirtual(physical));
 }
 
 fn allocTable() u64 {
@@ -102,12 +103,12 @@ fn mapRangePhysmap(pml4: u64, physical_base: u64, len: u64, flags: u64) void {
     var address = physical_base & ~@as(u64, page_size - 1);
     const end = physical_base + len;
     while (address < end) : (address += page_size) {
-        mapPage(pml4, system.physicalToVirtual(address), address, flags);
+        mapPage(pml4, boot_handoff.physicalToVirtual(address), address, flags);
     }
 }
 
-fn regions(mm: system.MemoryMap) []const system.MemoryRegion {
-    return @as([*]const system.MemoryRegion, @ptrFromInt(system.physicalToVirtual(mm.regions)))[0..mm.len];
+fn regions(mm: boot_handoff.MemoryMap) []const boot_handoff.MemoryRegion {
+    return @as([*]const boot_handoff.MemoryRegion, @ptrFromInt(boot_handoff.physicalToVirtual(mm.regions)))[0..mm.len];
 }
 
 /// Enable the NX bit in the page-table format (EFER.NXE). Must happen before we
@@ -118,7 +119,7 @@ fn enableNx() void {
 }
 
 /// Build the address space and switch onto it.
-pub fn init(allocFrame: *const fn () ?u64, freeFrame: *const fn (u64) void, boot_information: *const system.BootInformation) void {
+pub fn init(allocFrame: *const fn () ?u64, freeFrame: *const fn (u64) void, boot_information: *const boot_handoff.BootInformation) void {
     alloc_frame = allocFrame;
     free_frame = freeFrame;
     enableNx();
@@ -136,7 +137,7 @@ pub fn init(allocFrame: *const fn () ?u64, freeFrame: *const fn (u64) void, boot
     //    the kernel touches directly), RW + NX.
     const fb = boot_information.framebuffer;
     mapRangePhysmap(pml4, fb.base, @as(u64, fb.height) * fb.pitch, present | writable | no_execute);
-    mapPage(pml4, system.physicalToVirtual(0xFEE00000), 0xFEE00000, present | writable | no_execute);
+    mapPage(pml4, boot_handoff.physicalToVirtual(0xFEE00000), 0xFEE00000, present | writable | no_execute);
 
     // 3. The kernel's own segments at their higher-half link addresses, mapped
     //    to their low physical load addresses with real ELF permissions: code
@@ -206,11 +207,11 @@ pub fn mapMmio(physical: u64, len: u64, writable_page: bool) u64 {
     const last = physical + (if (len == 0) 1 else len) - 1;
     var address = first;
     while (address <= (last & ~@as(u64, page_size - 1))) : (address += page_size) {
-        const virtual = system.physicalToVirtual(address);
+        const virtual = boot_handoff.physicalToVirtual(address);
         mapPage(kernel_pml4, virtual, address, flags);
         invalidate(virtual);
     }
-    return system.physicalToVirtual(physical);
+    return boot_handoff.physicalToVirtual(physical);
 }
 
 /// Like `descend`, but also sets the U/S bit on the intermediate entry (new or