Post-reorg cleanup: POSIX layer, and naming fixes

Follow-up to the monorepo re-org. Suite 35/35 plus host tests green.

POSIX compatibility is now its own library, library/posix/ (unistd, stdio),
layered strictly over the runtime — it calls the runtime's IPC/heap, never
system calls directly. The runtime is now POSIX-free (the danos-native
application ABI). The VFS wire protocol is danos-native throughout
(Stat -> FileStatus, .stat -> .status, O_CREAT -> create); the POSIX layer
maps the POSIX spellings at the boundary. The coding standard's ABI-name
exception is scoped to one place: a file is allowed POSIX spellings only if it
lives under library/posix/ — everywhere else, danos naming with no exception.

Naming fixes, all mechanical:
- initrd -> initial-ramdisk: the source file, the module, the tool
  (make-initial-ramdisk.py), the artifact (initial-ramdisk.img, including the
  bootloader's load path), and the identifiers.
- system/kernel/device-service.zig -> devices-broker.zig: it is ring-0 kernel
  code (the trusted device table + claim capability), not a ring-3 service. The
  future user-space device *manager* (policy) will live in system/services/.
- Dropped the daemon `d` suffix: hpetd -> hpet, busd -> bus. A driver lives in
  system/drivers/, so the folder already says what it is; encoding the role in
  the name too is redundant. The coding standard drops that exception.
- system/devices/aml/interp.zig -> interpreter.zig (the type was already
  Interpreter).

docs/README.md

@@ -128,22 +128,29 @@ what you see under `system/` in the source is what a running danos represents un
 ```
 system/          → /system   danos's own internals (the self-representation)
   danos.zig                   the kernel↔user ABI contract (the `danos` module)
-  parameters.zig  initrd.zig  shared contracts
+  parameters.zig  initial-ramdisk.zig  shared contracts
   kernel/                     IPC, memory, scheduling, the private syscall dispatch
     architecture/x86_64/      the `architecture` module (never named by generic code)
   devices/                    the device model /system/devices reflects (+ aml/)
-  drivers/     hpetd/ busd/   one sub-project per driver → /system/drivers
+  drivers/     hpet/ bus/   one sub-project per driver → /system/drivers
   services/    init/ vfs/     system servers → /system/services (vfs/ holds
                               vfs.zig, vfs-test.zig, protocol.zig)
-library/         → /lib       the runtime library (the stable application ABI)
+library/         → /lib       libraries, one sub-directory each
+  runtime/                    the danos-native runtime — the stable application ABI
+  posix/                      POSIX/C compatibility, layered over runtime
 boot/            → /boot      the loaders
 tools/  test/                 host-side build + QEMU test harness
 ```
 
 A sub-project exposes its **public interface as a module**: `system/services/vfs/` owns
-the VFS wire protocol (`protocol.zig`, the `vfs-protocol` module), which the runtime's
-file layer imports by name. `usb`/`block` drivers will expose their protocols the same
-way.
+the VFS wire protocol (`protocol.zig`, the `vfs-protocol` module), which the POSIX
+layer imports by name. `usb`/`block` drivers will expose their protocols the same way.
+
+`library/posix/` is special: it is the **one place** POSIX/C spellings are allowed
+verbatim (`stat`, `O_CREAT`, `fopen`, `errno`). Everywhere else follows the danos
+naming rule with no exception — see [coding-standards.md](coding-standards.md). The
+POSIX layer calls the runtime, never the kernel's system calls directly, so it never
+appears in the private-ABI path.
 
 ## Source map
 
@@ -159,14 +166,15 @@ way.
 | IPC channels between kernel threads (message passing) | `system/kernel/ipc.zig` |
 | IPC endpoints: cross-address-space call/reply, handles, notifications | `system/kernel/ipc-synchronous.zig` |
 | User processes: ELF loading, address spaces, the syscall table | `system/kernel/process.zig` |
-| Device tree + claim capability + `device_register` containment | `system/kernel/device-service.zig` |
+| Device tree + claim capability + `device_register` containment | `system/kernel/devices-broker.zig` |
 | IRQ-as-IPC: routing a device interrupt to a driver's endpoint | `system/kernel/irq.zig` |
 | Hardware discovery (ACPI/device tree) behind one neutral device model | `system/devices/` |
 | Framebuffer text console (mirrors to serial) | `system/kernel/console.zig` |
 | In-kernel test cases | `system/kernel/tests.zig` |
 | Arch-specific kernel code (`halt`, GDT/IDT/TSS, exception + interrupt stubs, page tables, APIC/IO-APIC/timer, serial, linker script) | `system/kernel/architecture/x86_64/` |
-| Runtime library (`runtime`): syscall wrappers, heap, stdio, IPC, device access — the stable application ABI | `library/runtime/` |
+| danos-native runtime (`runtime`): syscall wrappers, heap, IPC, device access — the stable application ABI | `library/runtime/` |
+| POSIX/C compatibility (`posix`): unistd, stdio — the one place POSIX names are allowed | `library/posix/` |
 | System services (init, the VFS server + its `protocol` module) | `system/services/` |
-| Device drivers, one sub-project each (`hpetd` leaf driver, `busd` bus driver) | `system/drivers/` |
+| Device drivers, one sub-project each (`hpet` leaf driver, `bus` bus driver) | `system/drivers/` |
 | Build + `run-x86-64` (QEMU/OVMF) | `build.zig` |
 | QEMU integration test harness | `test/qemu_test.py` |