Split the system contract into boot-handoff / abi / device-abi

The `system` module (formerly `danos`) had become a grab-bag: it held the
loader<->kernel handoff *and* the kernel<->user ABI *and* the device wire types, in
one module three different audiences imported. Usage proved the seam — the
bootloader never touched the syscall/device ABI, and user space never touched the
boot handoff — so split it by audience, one module per contract:

  system/boot-handoff.zig       loader <-> kernel: BootInformation, Framebuffer,
                                MemoryMap, the VM layout + physicalToVirtual, kernel_abi
  system/abi.zig                kernel <-> user, core: SystemCall, mmap prot flags,
                                page_size, notify_badge_bit, ServiceId
  system/devices/device-abi.zig kernel <-> user, devices: DeviceDescriptor,
                                DeviceClass, ResourceDescriptor, ResourceKind, ...

device-abi is the devices sub-project's public interface, exposed as its own module
the way vfs exposes vfs-protocol — importable by user space, unlike the
kernel-internal device model it also feeds. That collapses a real duplication:
DeviceClass and ResourceKind were defined twice (device-model.zig and the contract,
kept "in sync by hand"); device-model now re-exports them from device-abi, so the
enum a driver matches on and the one the kernel classifies with are one type.

Each import now declares which contract it speaks: the bootloader imports only
boot-handoff; a driver only abi + device-abi (via the runtime); the kernel all
three. This also retires the `system` / `runtime.system` name overlap. page_size
lands in abi (it's part of the mmap contract user space aligns to); the bootloader
keeps its own local 4 KiB constant so it depends on nothing but the handoff.

All 21 importers rewired, docs updated to keep /system mapping to source. Build,
host tests, and the QEMU suite (36/36) all green.

system/kernel/devices-broker.zig

@@ -20,7 +20,7 @@
 
 const std = @import("std");
 const platform = @import("platform");
-const system = @import("system"); 
+const device_abi = @import("device-abi");
 
 const maximum_devices = 64;
 
@@ -32,7 +32,7 @@ const maximum_devices = 64;
 /// `device_release` to reclaim on exit) is future work — see docs/driver-model.md.
 const maximum_children_per_parent = 16;
 
-var devices: [maximum_devices]system.DeviceDescriptor = undefined;
+var devices: [maximum_devices]device_abi.DeviceDescriptor = undefined;
 var claimed: [maximum_devices]?u32 = .{null} ** maximum_devices; // owner task id, or null
 var count: usize = 0;
 
@@ -46,13 +46,13 @@ pub fn init(device_tree: *const platform.DeviceTree) void {
     count = 0;
     dropped = 0;
     for (&claimed) |*c| c.* = null;
-    walk(device_tree.root, system.no_parent);
+    walk(device_tree.root, device_abi.no_parent);
 }
 
 /// Record `node` (unless it's the synthetic root) and recurse, threading the id we
 /// assigned it down to its children as their parent.
 fn walk(node: *platform.Device, parent_id: u64) void {
-    const id = if (node.class == .root) system.no_parent else record(node, parent_id);
+    const id = if (node.class == .root) device_abi.no_parent else record(node, parent_id);
     var child = node.first_child;
     while (child) |c| : (child = c.next_sibling) walk(c, id);
 }
@@ -60,16 +60,16 @@ fn walk(node: *platform.Device, parent_id: u64) void {
 fn record(node: *platform.Device, parent_id: u64) u64 {
     if (count >= maximum_devices) {
         dropped += 1;
-        return system.no_parent; // children of a dropped node become roots, not orphans
+        return device_abi.no_parent; // children of a dropped node become roots, not orphans
     }
-    var d = std.mem.zeroes(system.DeviceDescriptor);
+    var d = std.mem.zeroes(device_abi.DeviceDescriptor);
     d.id = count;
     d.parent = parent_id;
     d.class = @intFromEnum(node.class);
     const h = node.hid();
     d.hid_len = @min(h.len, d.hid.len);
     @memcpy(d.hid[0..d.hid_len], h[0..d.hid_len]);
-    const rc = @min(node.resource_count, system.maximum_device_resources);
+    const rc = @min(node.resource_count, device_abi.maximum_device_resources);
     d.resource_count = rc;
     for (0..rc) |i| {
         const r = node.resources[i];
@@ -82,7 +82,7 @@ fn record(node: *platform.Device, parent_id: u64) u64 {
 
 /// Copy up to `out.len` device descriptors into `out`; returns the total count
 /// available (which may exceed `out.len`).
-pub fn enumerate(out: []system.DeviceDescriptor) usize {
+pub fn enumerate(out: []device_abi.DeviceDescriptor) usize {
     const n = @min(count, out.len);
     @memcpy(out[0..n], devices[0..n]);
     return count;
@@ -104,7 +104,7 @@ pub fn ownerOf(id: u64) ?u32 {
 }
 
 /// Resource `index` of device `id`, or null if out of range.
-pub fn resourceOf(id: u64, index: u64) ?system.ResourceDescriptor {
+pub fn resourceOf(id: u64, index: u64) ?device_abi.ResourceDescriptor {
     if (id >= count) return null;
     const d = &devices[@intCast(id)];
     if (index >= d.resource_count) return null;
@@ -115,9 +115,9 @@ pub fn resourceOf(id: u64, index: u64) ?system.ResourceDescriptor {
 /// interval containment; for an irq it's equality, since an interrupt line is not
 /// divisible. Zero-length child ranges are refused — an empty window is meaningless
 /// and would otherwise vacuously "fit" anywhere.
-fn contains(parent: system.ResourceDescriptor, child: system.ResourceDescriptor) bool {
+fn contains(parent: device_abi.ResourceDescriptor, child: device_abi.ResourceDescriptor) bool {
     if (parent.kind != child.kind) return false;
-    if (child.kind == @intFromEnum(system.ResourceKind.irq)) return parent.start == child.start;
+    if (child.kind == @intFromEnum(device_abi.ResourceKind.irq)) return parent.start == child.start;
     if (child.len == 0 or parent.len == 0) return false;
     // No overflow: a resource that wraps the address space is not containable.
     const child_end = std.math.add(u64, child.start, child.len) catch return false;
@@ -149,10 +149,10 @@ fn childCount(parent_id: u64) usize {
 /// `owner` must have claimed `parent_id`, and every resource in `descriptor` must be
 /// contained in a parent resource of the same kind. A device with no resources is
 /// fine and common: a USB device is addressed through its controller, not by MMIO.
-pub fn register(parent_id: u64, owner: u32, descriptor: *const system.DeviceDescriptor) RegisterError!u64 {
+pub fn register(parent_id: u64, owner: u32, descriptor: *const device_abi.DeviceDescriptor) RegisterError!u64 {
     const parent_owner = ownerOf(parent_id) orelse return error.BadParent;
     if (parent_owner != owner) return error.BadParent;
-    if (descriptor.resource_count > system.maximum_device_resources) return error.TooManyResources;
+    if (descriptor.resource_count > device_abi.maximum_device_resources) return error.TooManyResources;
     if (childCount(parent_id) >= maximum_children_per_parent) return error.TooManyChildren;
     if (count >= maximum_devices) return error.NoSpace;
 
@@ -166,7 +166,7 @@ pub fn register(parent_id: u64, owner: u32, descriptor: *const system.DeviceDesc
         if (!ok) return error.NotContained;
     }
 
-    var d = std.mem.zeroes(system.DeviceDescriptor);
+    var d = std.mem.zeroes(device_abi.DeviceDescriptor);
     d.id = count;
     d.parent = parent_id;
     d.class = descriptor.class;