Post-reorg cleanup: POSIX layer, and naming fixes

Follow-up to the monorepo re-org. Suite 35/35 plus host tests green.

POSIX compatibility is now its own library, library/posix/ (unistd, stdio),
layered strictly over the runtime — it calls the runtime's IPC/heap, never
system calls directly. The runtime is now POSIX-free (the danos-native
application ABI). The VFS wire protocol is danos-native throughout
(Stat -> FileStatus, .stat -> .status, O_CREAT -> create); the POSIX layer
maps the POSIX spellings at the boundary. The coding standard's ABI-name
exception is scoped to one place: a file is allowed POSIX spellings only if it
lives under library/posix/ — everywhere else, danos naming with no exception.

Naming fixes, all mechanical:
- initrd -> initial-ramdisk: the source file, the module, the tool
  (make-initial-ramdisk.py), the artifact (initial-ramdisk.img, including the
  bootloader's load path), and the identifiers.
- system/kernel/device-service.zig -> devices-broker.zig: it is ring-0 kernel
  code (the trusted device table + claim capability), not a ring-3 service. The
  future user-space device *manager* (policy) will live in system/services/.
- Dropped the daemon `d` suffix: hpetd -> hpet, busd -> bus. A driver lives in
  system/drivers/, so the folder already says what it is; encoding the role in
  the name too is redundant. The coding standard drops that exception.
- system/devices/aml/interp.zig -> interpreter.zig (the type was already
  Interpreter).

docs/coding-standards.md

@@ -6,7 +6,7 @@ Conventions for danos source. The overriding one, from which most of the rest fo
 > abbreviation is an acronym.**
 
 `interruptDispatch`, not `intDisp`. `message_len`, not `message_len` (`msg` expands, `len`
-is a Zig idiom — see the exceptions). `device_service`, not `device_service`. `scheduler`, not
+is a Zig idiom — see the exceptions). `devices_broker`, not `devices_broker`. `scheduler`, not
 `sched`. The cost of a longer name is paid once, at the keyboard; the cost of a
 cryptic one is paid every time the code is read, by everyone who reads it. In a
 microkernel whose whole argument is that a human can hold each piece in their head,
@@ -58,13 +58,22 @@ abbreviation, expand it.
 
 Three, and only three.
 
-1. **Foreign ABI names are spelled exactly as the ABI spells them.** A function that
-   *is* the C or POSIX interface keeps its name: `fopen`, `fwrite`, `fread`, `malloc`,
-   `calloc`, `realloc`, `free`, `memcpy`, `mmap`, `munmap`, `open`, `read`, `write`,
-   `close`, `lseek`, `stat`, `errno`. We don't get to rename `fwrite` to
-   `fileWrite` — it wouldn't be `fwrite` any more. This also covers the syscall
-   *wrappers* that exist to match those names. It does **not** license inventing new
-   abbreviated names in that style.
+1. **Foreign ABI names are spelled exactly as the ABI spells them — but only inside
+   the layer that *is* that ABI.** A function that *is* the C or POSIX interface keeps
+   its name: `fopen`, `fwrite`, `fread`, `malloc`, `calloc`, `realloc`, `free`,
+   `memcpy`, `mmap`, `munmap`, `open`, `read`, `write`, `close`, `lseek`, `stat`,
+   `errno`, `O_CREAT`. We don't get to rename `fwrite` to `fileWrite` — it wouldn't be
+   `fwrite` any more.
+
+   **This exception is scoped to one place: `library/posix/`.** A file under
+   `library/posix/` *is* the foreign ABI, so it keeps the ABI's spellings — that is the
+   whole rule for that directory. **Everywhere else, Zig/danos naming applies with no
+   POSIX exception**, so there is nothing to get wrong: if you're not in
+   `library/posix/`, expand it. A concept POSIX also has gets a danos name outside that
+   layer — the VFS wire protocol carries a `FileStatus`, not a `Stat`, and a `create`
+   flag, not `O_CREAT`; `library/posix/` is what maps `stat`→`status` and
+   `O_CREAT`→`create` at the boundary. (The `syscall` *wrappers* elsewhere are not an
+   exception to this — they wrap the private danos ABI, so they use danos names.)
 
 2. **Zig idioms are spelled the way Zig spells them.** Three names are the language's,
    not ours, and are left alone:
@@ -83,11 +92,12 @@ Three, and only three.
    keep `i`; a coordinate may be `x`, `y`. The moment the scope is big enough that the
    letter's meaning isn't obvious on sight, give it a real name. When in doubt, name it.
 
-4. **Established Unix filesystem and program conventions.** Top-level directories keep
-   their conventional names — `src`, `lib`, `sbin`, `bin`, `docs` — as do daemon
-   programs by their `d` suffix (`hpetd`, `busd`, following `sshd`/`httpd`). These are
-   names a Unix reader already knows; expanding them fights the convention rather than
-   serving it.
+That's all — no Unix-abbreviation exception. The source directories are full words
+(`system`, `library`, not `src`/`lib`), and there is no daemon `d` suffix: a driver
+lives in `system/drivers/` and a service in `system/services/`, so the *location*
+already says what it is. Encoding the role in the name too (`busd`, `vfsd`) is
+redundant — the program is just `bus`, `vfs`. Don't put in a name what its directory
+already tells you.
 
 ## A note on collisions
 
@@ -118,11 +128,11 @@ Within those spelling rules, follow Zig's own conventions:
 
 - **Types** — `PascalCase`: `DeviceDescriptor`, `Endpoint`, `WaitQueue`.
 - **Functions** — `camelCase`: `mapUserDeviceInto`, `notifyFromIsr`.
-- **Variables, fields, constants** — `snake_case`: `message_length`, `device_service`,
+- **Variables, fields, constants** — `snake_case`: `message_length`, `devices_broker`,
   `notify_badge_bit`.
 
 **File names are `kebab-case`.** A file named for a multi-word thing hyphenates it:
-`device-tree.zig`, `ipc-synchronous.zig`, `vfs-protocol.zig`, `device-service.zig`. A
+`device-tree.zig`, `ipc-synchronous.zig`, `vfs-protocol.zig`, `devices-broker.zig`. A
 single word or acronym needs no hyphen: `scheduler.zig`, `paging.zig`, `apic.zig`,
 `idt.zig`. (The module *alias* a file is imported under still follows the code
 conventions above — `snake_case` — because it's an identifier, not a filename.)