Split the system contract into boot-handoff / abi / device-abi

The `system` module (formerly `danos`) had become a grab-bag: it held the
loader<->kernel handoff *and* the kernel<->user ABI *and* the device wire types, in
one module three different audiences imported. Usage proved the seam — the
bootloader never touched the syscall/device ABI, and user space never touched the
boot handoff — so split it by audience, one module per contract:

  system/boot-handoff.zig       loader <-> kernel: BootInformation, Framebuffer,
                                MemoryMap, the VM layout + physicalToVirtual, kernel_abi
  system/abi.zig                kernel <-> user, core: SystemCall, mmap prot flags,
                                page_size, notify_badge_bit, ServiceId
  system/devices/device-abi.zig kernel <-> user, devices: DeviceDescriptor,
                                DeviceClass, ResourceDescriptor, ResourceKind, ...

device-abi is the devices sub-project's public interface, exposed as its own module
the way vfs exposes vfs-protocol — importable by user space, unlike the
kernel-internal device model it also feeds. That collapses a real duplication:
DeviceClass and ResourceKind were defined twice (device-model.zig and the contract,
kept "in sync by hand"); device-model now re-exports them from device-abi, so the
enum a driver matches on and the one the kernel classifies with are one type.

Each import now declares which contract it speaks: the bootloader imports only
boot-handoff; a driver only abi + device-abi (via the runtime); the kernel all
three. This also retires the `system` / `runtime.system` name overlap. page_size
lands in abi (it's part of the mmap contract user space aligns to); the bootloader
keeps its own local 4 KiB constant so it depends on nothing but the handoff.

All 21 importers rewired, docs updated to keep /system mapping to source. Build,
host tests, and the QEMU suite (36/36) all green.

system/kernel/pmm.zig

@@ -2,14 +2,15 @@
 //! 4 KiB physical frames — the primitive every later memory feature (page
 //! tables, the heap) is built on top of.
 //!
-//! This is generic kernel code: it works on the neutral `system.MemoryRegion`
+//! This is generic kernel code: it works on the neutral `boot_handoff.MemoryRegion`
 //! array the loader hands over (see docs/memory-map.md), so it carries no UEFI
 //! and nothing architecture-specific beyond the 4 KiB page.
 
 const std = @import("std");
-const system = @import("system");
+const boot_handoff = @import("boot-handoff");
+const abi = @import("abi");
 
-const page_size = system.page_size;
+const page_size = abi.page_size;
 
 /// One bit per frame, covering physical RAM from 0 up to the highest usable
 /// address: 1 = used/unavailable, 0 = free. The bitmap itself lives in a frame
@@ -48,8 +49,8 @@ inline fn setFree(frame: usize) void {
     bitmap[frame >> 3] &= ~(@as(u8, 1) << bit(frame));
 }
 
-fn regions(map: system.MemoryMap) []const system.MemoryRegion {
-    return @as([*]const system.MemoryRegion, @ptrFromInt(system.physicalToVirtual(map.regions)))[0..map.len];
+fn regions(map: boot_handoff.MemoryMap) []const boot_handoff.MemoryRegion {
+    return @as([*]const boot_handoff.MemoryRegion, @ptrFromInt(boot_handoff.physicalToVirtual(map.regions)))[0..map.len];
 }
 
 /// Build the allocator from the loader's memory map. Reaches physical memory
@@ -59,7 +60,7 @@ fn regions(map: system.MemoryMap) []const system.MemoryRegion {
 /// region (lowest address), which must sit under the bootstrap physmap's reach
 /// (4 GiB); it always does, as both this and the page-table allocator scan from
 /// low addresses up.
-pub fn init(map: system.MemoryMap) void {
+pub fn init(map: boot_handoff.MemoryMap) void {
     const regs = regions(map);
 
     // 1. Size the bitmap to cover every frame up to the highest RAM address —
@@ -91,7 +92,7 @@ pub fn init(map: system.MemoryMap) void {
         }
     }
     const bitmap_base = storage orelse @panic("pmm: no region large enough for the frame bitmap");
-    bitmap = @as([*]u8, @ptrFromInt(system.physicalToVirtual(bitmap_base)))[0..bitmap_bytes];
+    bitmap = @as([*]u8, @ptrFromInt(boot_handoff.physicalToVirtual(bitmap_base)))[0..bitmap_bytes];
 
     // 3. Start with everything marked used, then free the usable regions. Doing
     //    it this way means every gap, reserved span and MMIO hole is unallocatable