Split the system contract into boot-handoff / abi / device-abi

The `system` module (formerly `danos`) had become a grab-bag: it held the
loader<->kernel handoff *and* the kernel<->user ABI *and* the device wire types, in
one module three different audiences imported. Usage proved the seam — the
bootloader never touched the syscall/device ABI, and user space never touched the
boot handoff — so split it by audience, one module per contract:

  system/boot-handoff.zig       loader <-> kernel: BootInformation, Framebuffer,
                                MemoryMap, the VM layout + physicalToVirtual, kernel_abi
  system/abi.zig                kernel <-> user, core: SystemCall, mmap prot flags,
                                page_size, notify_badge_bit, ServiceId
  system/devices/device-abi.zig kernel <-> user, devices: DeviceDescriptor,
                                DeviceClass, ResourceDescriptor, ResourceKind, ...

device-abi is the devices sub-project's public interface, exposed as its own module
the way vfs exposes vfs-protocol — importable by user space, unlike the
kernel-internal device model it also feeds. That collapses a real duplication:
DeviceClass and ResourceKind were defined twice (device-model.zig and the contract,
kept "in sync by hand"); device-model now re-exports them from device-abi, so the
enum a driver matches on and the one the kernel classifies with are one type.

Each import now declares which contract it speaks: the bootloader imports only
boot-handoff; a driver only abi + device-abi (via the runtime); the kernel all
three. This also retires the `system` / `runtime.system` name overlap. page_size
lands in abi (it's part of the mmap contract user space aligns to); the bootloader
keeps its own local 4 KiB constant so it depends on nothing but the handoff.

All 21 importers rewired, docs updated to keep /system mapping to source. Build,
host tests, and the QEMU suite (36/36) all green.

system/kernel/kernel.zig

@@ -1,5 +1,6 @@
 const std = @import("std");
-const system = @import("system");
+const boot_handoff = @import("boot-handoff");
+const abi = @import("abi");
 const parameters = @import("parameters");
 const architecture = @import("architecture");
 const console = @import("console.zig");
@@ -14,14 +15,14 @@ const initial_ramdisk = @import("initial-ramdisk");
 const platform = @import("platform");
 const tests = @import("tests.zig");
 const build_options = @import("build_options");
-const BootInformation = system.BootInformation;
+const BootInformation = boot_handoff.BootInformation;
 
 /// The calling convention used to enter the kernel. Pinned to SystemV explicitly:
 /// the bootloader is built for the UEFI target, whose C convention is Microsoft
 /// x64 (first argument in RCX), while the kernel is SystemV (first argument in
 /// RDI). Both sides reference this so the `boot_information` pointer lands in the
-/// register the other expects. `system.kernel_abi` re-exports it to the loader.
-pub const kernel_abi = system.kernel_abi;
+/// register the other expects. `boot_handoff.kernel_abi` re-exports it to the loader.
+pub const kernel_abi = boot_handoff.kernel_abi;
 
 // POST/checkpoint codes emitted to I/O port 0x80 at boot milestones — the
 // last-resort progress signal on a machine with no text output at all.
@@ -50,7 +51,7 @@ var ap_trampoline_page: u64 = 0;
 /// half. `boot_information` (also low) is reached through the physmap — its base is the
 /// same under the loader's bootstrap tables and the kernel's own.
 export fn kmainEntry(boot_information: *const BootInformation) callconv(kernel_abi) noreturn {
-    kmain(@ptrFromInt(system.physicalToVirtual(@intFromPtr(boot_information))));
+    kmain(@ptrFromInt(boot_handoff.physicalToVirtual(@intFromPtr(boot_information))));
 }
 
 fn kmain(boot_information: *const BootInformation) noreturn {
@@ -91,7 +92,7 @@ fn kmain(boot_information: *const BootInformation) noreturn {
 
     // Summarise the physical memory the loader handed us. The array is danos's
     // own MemoryRegion, so this is a plain slice — no firmware layout in sight.
-    const regions = @as([*]const system.MemoryRegion, @ptrFromInt(system.physicalToVirtual(boot_information.memory_map.regions)))[0..boot_information.memory_map.len];
+    const regions = @as([*]const boot_handoff.MemoryRegion, @ptrFromInt(boot_handoff.physicalToVirtual(boot_information.memory_map.regions)))[0..boot_information.memory_map.len];
     var usable_pages: u64 = 0;
     var reserved_pages: u64 = 0; // reserved RAM only — MMIO is device space, not RAM
     for (regions) |r| {
@@ -102,7 +103,7 @@ fn kmain(boot_information: *const BootInformation) noreturn {
         }
     }
     const total_pages = usable_pages + reserved_pages;
-    const total_bytes = total_pages * system.page_size;
+    const total_bytes = total_pages * abi.page_size;
     const gib = 1 << 30;
 
     log.write("\ndanos: physical memory\n");
@@ -277,7 +278,7 @@ fn kmain(boot_information: *const BootInformation) noreturn {
     // borrowing. This boot context then becomes the BSP's idle loop.
     if (boot_information.init_len != 0) {
         status("starting /sbin/init...\n");
-        const image = @as([*]const u8, @ptrFromInt(system.physicalToVirtual(boot_information.init_base)))[0..boot_information.init_len];
+        const image = @as([*]const u8, @ptrFromInt(boot_handoff.physicalToVirtual(boot_information.init_base)))[0..boot_information.init_len];
         process.spawnProcess(image, 4) catch |err| {
             statusPrint("/sbin/init failed to load: {s}\n", .{@errorName(err)});
         };
@@ -300,9 +301,9 @@ fn kmain(boot_information: *const BootInformation) noreturn {
 /// Spawn every program bundled in the initial_ramdisk as its own ring-3 process. A bad
 /// image or a program that fails to load is logged and skipped — the rest of the
 /// system still runs.
-fn startInitialRamdiskBinaries(boot_information: *const system.BootInformation) void {
+fn startInitialRamdiskBinaries(boot_information: *const boot_handoff.BootInformation) void {
     if (boot_information.initial_ramdisk_len == 0) return;
-    const image = @as([*]const u8, @ptrFromInt(system.physicalToVirtual(boot_information.initial_ramdisk_base)))[0..boot_information.initial_ramdisk_len];
+    const image = @as([*]const u8, @ptrFromInt(boot_handoff.physicalToVirtual(boot_information.initial_ramdisk_base)))[0..boot_information.initial_ramdisk_len];
     const rd = initial_ramdisk.Reader.init(image) orelse {
         status("initial_ramdisk: bad image, skipping\n");
         return;
@@ -386,11 +387,11 @@ fn statusPrint(comptime fmt: []const u8, args: anytype) void {
 
 /// Frames (4 KiB pages) to whole MiB.
 fn mib(pages: u64) u64 {
-    return pages * system.page_size / (1024 * 1024);
+    return pages * abi.page_size / (1024 * 1024);
 }
 
 fn kib(frames: u64) u64 {
-    return frames * system.page_size / (1024);
+    return frames * abi.page_size / (1024);
 }
 
 /// Report a CPU exception and halt **this core**. There's no fault recovery yet, so