Post-reorg cleanup: POSIX layer, and naming fixes

Follow-up to the monorepo re-org. Suite 35/35 plus host tests green.

POSIX compatibility is now its own library, library/posix/ (unistd, stdio),
layered strictly over the runtime — it calls the runtime's IPC/heap, never
system calls directly. The runtime is now POSIX-free (the danos-native
application ABI). The VFS wire protocol is danos-native throughout
(Stat -> FileStatus, .stat -> .status, O_CREAT -> create); the POSIX layer
maps the POSIX spellings at the boundary. The coding standard's ABI-name
exception is scoped to one place: a file is allowed POSIX spellings only if it
lives under library/posix/ — everywhere else, danos naming with no exception.

Naming fixes, all mechanical:
- initrd -> initial-ramdisk: the source file, the module, the tool
  (make-initial-ramdisk.py), the artifact (initial-ramdisk.img, including the
  bootloader's load path), and the identifiers.
- system/kernel/device-service.zig -> devices-broker.zig: it is ring-0 kernel
  code (the trusted device table + claim capability), not a ring-3 service. The
  future user-space device *manager* (policy) will live in system/services/.
- Dropped the daemon `d` suffix: hpetd -> hpet, busd -> bus. A driver lives in
  system/drivers/, so the folder already says what it is; encoding the role in
  the name too is redundant. The coding standard drops that exception.
- system/devices/aml/interp.zig -> interpreter.zig (the type was already
  Interpreter).

docs/drivers.md

@@ -40,7 +40,7 @@ memory; if `irq_bind` took a GSI, any process could bind the keyboard's line and
 silently intercept it. Instead the kernel checks two things (`process.ownedGsi`, and
 the same check at the top of `sysMmioMap`):
 
-- `device_service.ownerOf(dev_id) == me` — you claimed it, and claims are exclusive
+- `devices_broker.ownerOf(dev_id) == me` — you claimed it, and claims are exclusive
 - the resource at `res_idx` is of the right *kind* — `memory` for `mmio_map`, `irq`
   for `irq_bind`
 
@@ -138,7 +138,7 @@ Two properties worth knowing:
 
 ## A whole driver
 
-`system/drivers/hpetd/hpetd.zig` is ~150 lines and does all of it. The shape:
+`system/drivers/hpet/hpet.zig` is ~150 lines and does all of it. The shape:
 
 ```zig
 const hpet = findHpet(buf) orelse return;      // device_enumerate, look for
@@ -206,7 +206,7 @@ bus driver may only ever subdivide what it already owns.
 A device with **no resources** is legal and common. A USB device is reached through its
 controller, not by MMIO, so it gets `resource_count = 0`.
 
-See [`system/drivers/busd/busd.zig`](../system/drivers/busd/busd.zig) for a complete one, and
+See [`system/drivers/bus/bus.zig`](../system/drivers/bus/bus.zig) for a complete one, and
 [driver-model.md](driver-model.md) for how bus drivers, class drivers and host
 controller drivers fit together.
 
@@ -269,8 +269,8 @@ Worth knowing before you write the second driver:
 
 ## Verifying it
 
-The `hpet` test spawns `hpetd` from the initrd and watches the serial log. The driver
-prints `hpetd: ok` only after being woken five times, and its loop's only exit is
+The `hpet` test spawns `hpet` from the initial ramdisk and watches the serial log. The driver
+prints `hpet: ok` only after being woken five times, and its loop's only exit is
 through `replyWait` returning a notification — it cannot reach that line by polling.
 
 The last check doesn't trust the driver's self-report at all: the kernel reads the I/O
@@ -285,7 +285,7 @@ $ python3 test/qemu_test.py hpet irqfree iopass
   iopass       ... PASS  (matched 'DANOS-TEST-RESULT: PASS')
 ```
 
-Two companions cover what `hpetd` can't, because it never exits:
+Two companions cover what `hpet` can't, because it never exits:
 
 - **`irqfree`** — the teardown path. Binds two owners to one shared endpoint, releases
   one, and reads the I/O APIC back: the departing owner's line is masked, the sibling's
@@ -305,7 +305,7 @@ controller drivers), and the IOMMU — have proposed signatures in
   I/O permission bitmap swapped on context switch, or `io_in`/`io_out` syscalls gated
   by the same claim. The legacy devices that need it are all low-rate, so the syscall
   is likely fast enough.
-- **Releasing a claim.** There is no `dev_release`, and `device_service` never drops a claim on
+- **Releasing a claim.** There is no `dev_release`, and `devices_broker` never drops a claim on
   exit — only IRQ bindings are released. A dead driver's device stays owned forever,
   which blocks restart.
 - **Unregistering children.** `device_register` only appends. A USB device that is