Post-reorg cleanup: POSIX layer, and naming fixes

Follow-up to the monorepo re-org. Suite 35/35 plus host tests green.

POSIX compatibility is now its own library, library/posix/ (unistd, stdio),
layered strictly over the runtime — it calls the runtime's IPC/heap, never
system calls directly. The runtime is now POSIX-free (the danos-native
application ABI). The VFS wire protocol is danos-native throughout
(Stat -> FileStatus, .stat -> .status, O_CREAT -> create); the POSIX layer
maps the POSIX spellings at the boundary. The coding standard's ABI-name
exception is scoped to one place: a file is allowed POSIX spellings only if it
lives under library/posix/ — everywhere else, danos naming with no exception.

Naming fixes, all mechanical:
- initrd -> initial-ramdisk: the source file, the module, the tool
  (make-initial-ramdisk.py), the artifact (initial-ramdisk.img, including the
  bootloader's load path), and the identifiers.
- system/kernel/device-service.zig -> devices-broker.zig: it is ring-0 kernel
  code (the trusted device table + claim capability), not a ring-3 service. The
  future user-space device *manager* (policy) will live in system/services/.
- Dropped the daemon `d` suffix: hpetd -> hpet, busd -> bus. A driver lives in
  system/drivers/, so the folder already says what it is; encoding the role in
  the name too is redundant. The coding standard drops that exception.
- system/devices/aml/interp.zig -> interpreter.zig (the type was already
  Interpreter).

library/posix/posix.zig

@@ -0,0 +1,13 @@
+//! DanOS's POSIX / C compatibility layer — `unistd`, `stdio`, and (later) the C
+//! `errno` / `struct stat` / `extern "C"` surface. This is the *one* place POSIX and
+//! C spellings are allowed to appear verbatim (see docs/coding-standards.md): a file
+//! under library/posix/ *is* the foreign ABI, so it keeps the ABI's names. Everything
+//! it touches on the danos side (the VFS protocol, the runtime) uses danos names,
+//! which this layer translates to at the boundary.
+//!
+//! It is layered strictly *over* the runtime: it calls the runtime's IPC and heap,
+//! never the kernel's system calls directly. danos-native applications use the
+//! runtime; this exists so *POSIX* software can too.
+
+pub const unistd = @import("unistd.zig");
+pub const stdio = @import("stdio.zig");

library/posix/stdio.zig

@@ -0,0 +1,115 @@
+//! A small C stdio layer over the POSIX-style file API (unistd.zig). Unbuffered
+//! for now — each fread/fwrite is one VFS round trip; an internal buffer (fewer
+//! IPC calls) is a later optimisation. Both a Zig-callable API and `extern "C"`
+//! symbols are provided, so Zig and future C programs share it.
+
+const std = @import("std");
+const unistd = @import("unistd.zig");
+const heap = @import("runtime").heap;
+
+pub const SEEK_SET = unistd.SEEK_SET;
+pub const SEEK_CURRENT = unistd.SEEK_CURRENT;
+pub const SEEK_END = unistd.SEEK_END;
+
+/// A C `FILE`: an fd plus sticky end-of-file / error flags. Allocated on the
+/// heap; `fclose` frees it.
+pub const FILE = extern struct {
+    fd: i32,
+    eof: c_int = 0,
+    err: c_int = 0,
+};
+
+fn flagsFor(mode: []const u8) u32 {
+    if (mode.len == 0) return 0;
+    return switch (mode[0]) {
+        'w', 'a' => unistd.O_CREAT,
+        else => 0,
+    };
+}
+
+/// Open `path` in `mode` ("r"/"w"/"a", '+' ignored for now). Returns null on error.
+pub fn fopen(path: []const u8, mode: []const u8) ?*FILE {
+    const fd = unistd.open(path, flagsFor(mode));
+    if (fd < 0) return null;
+    const f = heap.allocator().create(FILE) catch {
+        unistd.close(fd);
+        return null;
+    };
+    f.* = .{ .fd = fd };
+    if (mode.len > 0 and mode[0] == 'a') _ = unistd.lseek(fd, 0, unistd.SEEK_END);
+    return f;
+}
+
+pub fn fclose(f: *FILE) c_int {
+    unistd.close(f.fd);
+    heap.allocator().destroy(f);
+    return 0;
+}
+
+/// Read `size*nmemb` bytes; returns the number of whole items read.
+pub fn fread(buffer: []u8, size: usize, nmemb: usize, f: *FILE) usize {
+    const total = size * nmemb;
+    if (total == 0) return 0;
+    const n = unistd.read(f.fd, buffer[0..@min(buffer.len, total)]);
+    if (n <= 0) {
+        f.eof = 1;
+        return 0;
+    }
+    return @as(usize, @intCast(n)) / size;
+}
+
+/// Write `size*nmemb` bytes; returns the number of whole items written.
+pub fn fwrite(data: []const u8, size: usize, nmemb: usize, f: *FILE) usize {
+    const total = @min(data.len, size * nmemb);
+    if (total == 0) return 0;
+    const n = unistd.write(f.fd, data[0..total]);
+    if (n <= 0) {
+        f.err = 1;
+        return 0;
+    }
+    return @as(usize, @intCast(n)) / size;
+}
+
+pub fn fseek(f: *FILE, off: i64, whence: u32) c_int {
+    f.eof = 0;
+    return if (unistd.lseek(f.fd, off, whence) < 0) -1 else 0;
+}
+
+pub fn ftell(f: *FILE) i64 {
+    return unistd.lseek(f.fd, 0, unistd.SEEK_CURRENT);
+}
+
+pub fn rewind(f: *FILE) void {
+    _ = fseek(f, 0, SEEK_SET);
+}
+
+pub fn feof(f: *FILE) c_int {
+    return f.eof;
+}
+
+pub fn ferror(f: *FILE) c_int {
+    return f.err;
+}
+
+pub fn fputs(s: []const u8, f: *FILE) c_int {
+    return if (unistd.write(f.fd, s) < 0) -1 else 0;
+}
+
+pub fn fputc(c: u8, f: *FILE) c_int {
+    const b = [_]u8{c};
+    return if (unistd.write(f.fd, &b) == 1) c else -1;
+}
+
+pub fn fgetc(f: *FILE) c_int {
+    var b: [1]u8 = undefined;
+    const n = unistd.read(f.fd, &b);
+    if (n <= 0) {
+        f.eof = 1;
+        return -1; // EOF
+    }
+    return b[0];
+}
+
+// Real `extern "C"` symbols (fopen/fread/fseek/...) — with a C-string signature
+// distinct from the Zig slice API above — land with the first C program, wired
+// via @export so they don't collide with these Zig names.

library/posix/unistd.zig

@@ -0,0 +1,149 @@
+//! POSIX-style file API for user programs — the low level under C stdio. Files
+//! are named objects served by the user-space VFS server (system/services/vfs/vfs.zig); each
+//! call marshals a request, IPC_Calls the VFS, and unmarshals the reply. The
+//! kernel knows nothing of files or fds — the fd table lives here, per process.
+
+const std = @import("std");
+const protocol = @import("vfs-protocol");
+const ipc = @import("runtime").ipc;
+const danos = @import("danos");
+
+pub const O_CREAT = protocol.create;
+pub const SEEK_SET: u32 = 0;
+pub const SEEK_CURRENT: u32 = 1;
+pub const SEEK_END: u32 = 2;
+
+// Resolve (and cache) the VFS server endpoint, looked up by well-known id.
+var vfs_handle: usize = 0;
+var vfs_resolved = false;
+fn vfs() ?usize {
+    if (!vfs_resolved) {
+        vfs_handle = ipc.lookup(.vfs) orelse return null;
+        vfs_resolved = true;
+    }
+    return vfs_handle;
+}
+
+const maximum_fds = 32;
+const Fd = struct { used: bool = false, node: u64 = 0, offset: u64 = 0 };
+var fds = [_]Fd{.{}} ** maximum_fds;
+
+fn allocFd() ?usize {
+    for (&fds, 0..) |*f, i| {
+        if (!f.used) {
+            f.* = .{ .used = true };
+            return i;
+        }
+    }
+    return null;
+}
+
+const Result = struct { reply: protocol.Reply, payload: []u8 };
+
+/// One request/reply round trip: [Request header][send payload] -> VFS ->
+/// [Reply header][receive payload]. The receive payload is written into `out`.
+fn transact(request: protocol.Request, send: []const u8, out: []u8) ?Result {
+    const h = vfs() orelse return null;
+    var message: [protocol.message_maximum]u8 = undefined;
+    @memcpy(message[0..protocol.request_size], std.mem.asBytes(&request));
+    const slen = @min(send.len, protocol.maximum_payload);
+    @memcpy(message[protocol.request_size..][0..slen], send[0..slen]);
+
+    var rbuf: [protocol.message_maximum]u8 = undefined;
+    const n = ipc.call(h, message[0 .. protocol.request_size + slen], &rbuf) catch return null;
+    if (n < protocol.reply_size) return null;
+    const reply = std.mem.bytesToValue(protocol.Reply, rbuf[0..protocol.reply_size]);
+    const rpl = @min(n - protocol.reply_size, out.len);
+    @memcpy(out[0..rpl], rbuf[protocol.reply_size..][0..rpl]);
+    return .{ .reply = reply, .payload = out[0..rpl] };
+}
+
+/// Open (or create, with O_CREAT) `path`; returns an fd or -1.
+pub fn open(path: []const u8, flags: u32) i32 {
+    const fd = allocFd() orelse return -1;
+    const request = protocol.Request{ .operation = .open, .node = 0, .offset = 0, .len = @intCast(path.len), .flags = flags };
+    const r = transact(request, path, &.{}) orelse {
+        fds[fd].used = false;
+        return -1;
+    };
+    if (r.reply.status != 0) {
+        fds[fd].used = false;
+        return -1;
+    }
+    fds[fd] = .{ .used = true, .node = r.reply.node, .offset = 0 };
+    return @intCast(fd);
+}
+
+fn fdPtr(fd: i32) ?*Fd {
+    if (fd < 0 or fd >= maximum_fds) return null;
+    const f = &fds[@intCast(fd)];
+    return if (f.used) f else null;
+}
+
+/// Read up to `buffer.len` bytes at the current offset; returns the count or -1.
+pub fn read(fd: i32, buffer: []u8) isize {
+    const f = fdPtr(fd) orelse return -1;
+    const want: u32 = @intCast(@min(buffer.len, protocol.maximum_payload));
+    const request = protocol.Request{ .operation = .read, .node = f.node, .offset = f.offset, .len = want, .flags = 0 };
+    const r = transact(request, &.{}, buffer) orelse return -1;
+    if (r.reply.status != 0) return -1;
+    f.offset += r.reply.len;
+    return @intCast(r.reply.len);
+}
+
+/// Write `data` at the current offset; returns the count or -1.
+pub fn write(fd: i32, data: []const u8) isize {
+    const f = fdPtr(fd) orelse return -1;
+    const want: u32 = @intCast(@min(data.len, protocol.maximum_payload));
+    const request = protocol.Request{ .operation = .write, .node = f.node, .offset = f.offset, .len = want, .flags = 0 };
+    const r = transact(request, data[0..want], &.{}) orelse return -1;
+    if (r.reply.status != 0) return -1;
+    f.offset += r.reply.len;
+    return @intCast(r.reply.len);
+}
+
+/// Reposition the fd's offset. Returns the new offset or -1. (SEEK_END needs the
+/// file size, which `stat` provides; handled by fetching it here.)
+pub fn lseek(fd: i32, off: i64, whence: u32) i64 {
+    const f = fdPtr(fd) orelse return -1;
+    const base: i64 = switch (whence) {
+        SEEK_SET => 0,
+        SEEK_CURRENT => @intCast(f.offset),
+        SEEK_END => blk: {
+            const request = protocol.Request{ .operation = .status, .node = f.node, .offset = 0, .len = 0, .flags = 0 };
+            var sbuf: [@sizeOf(protocol.FileStatus)]u8 = undefined;
+            const r = transact(request, &.{}, &sbuf) orelse return -1;
+            if (r.reply.status != 0 or r.payload.len < @sizeOf(protocol.FileStatus)) return -1;
+            const st = std.mem.bytesToValue(protocol.FileStatus, sbuf[0..@sizeOf(protocol.FileStatus)]);
+            break :blk @intCast(st.size);
+        },
+        else => return -1,
+    };
+    const pos = base + off;
+    if (pos < 0) return -1;
+    f.offset = @intCast(pos);
+    return pos;
+}
+
+/// Stat `path`. Returns 0 or -1.
+pub fn stat(path: []const u8, out: *protocol.FileStatus) i32 {
+    // Open, stat by node, close — simple and enough for now.
+    const fd = open(path, 0);
+    if (fd < 0) return -1;
+    defer close(fd);
+    const f = fdPtr(fd).?;
+    const request = protocol.Request{ .operation = .status, .node = f.node, .offset = 0, .len = 0, .flags = 0 };
+    var sbuf: [@sizeOf(protocol.FileStatus)]u8 = undefined;
+    const r = transact(request, &.{}, &sbuf) orelse return -1;
+    if (r.reply.status != 0 or r.payload.len < @sizeOf(protocol.FileStatus)) return -1;
+    out.* = std.mem.bytesToValue(protocol.FileStatus, sbuf[0..@sizeOf(protocol.FileStatus)]);
+    return 0;
+}
+
+/// Close an fd (best effort — tells the VFS to release the open file).
+pub fn close(fd: i32) void {
+    const f = fdPtr(fd) orelse return;
+    const request = protocol.Request{ .operation = .close, .node = f.node, .offset = 0, .len = 0, .flags = 0 };
+    _ = transact(request, &.{}, &.{});
+    f.used = false;
+}