Post-reorg cleanup: POSIX layer, and naming fixes

Follow-up to the monorepo re-org. Suite 35/35 plus host tests green.

POSIX compatibility is now its own library, library/posix/ (unistd, stdio),
layered strictly over the runtime — it calls the runtime's IPC/heap, never
system calls directly. The runtime is now POSIX-free (the danos-native
application ABI). The VFS wire protocol is danos-native throughout
(Stat -> FileStatus, .stat -> .status, O_CREAT -> create); the POSIX layer
maps the POSIX spellings at the boundary. The coding standard's ABI-name
exception is scoped to one place: a file is allowed POSIX spellings only if it
lives under library/posix/ — everywhere else, danos naming with no exception.

Naming fixes, all mechanical:
- initrd -> initial-ramdisk: the source file, the module, the tool
  (make-initial-ramdisk.py), the artifact (initial-ramdisk.img, including the
  bootloader's load path), and the identifiers.
- system/kernel/device-service.zig -> devices-broker.zig: it is ring-0 kernel
  code (the trusted device table + claim capability), not a ring-3 service. The
  future user-space device *manager* (policy) will live in system/services/.
- Dropped the daemon `d` suffix: hpetd -> hpet, busd -> bus. A driver lives in
  system/drivers/, so the folder already says what it is; encoding the role in
  the name too is redundant. The coding standard drops that exception.
- system/devices/aml/interp.zig -> interpreter.zig (the type was already
  Interpreter).

system/kernel/process.zig

@@ -27,7 +27,7 @@ const pmm = @import("pmm.zig");
 const scheduler = @import("scheduler.zig");
 const sync = @import("sync.zig");
 const ipc = @import("ipc-synchronous.zig");
-const device_service = @import("device-service.zig");
+const devices_broker = @import("devices-broker.zig");
 const irq = @import("irq.zig");
 const log = @import("log.zig");
 
@@ -206,12 +206,12 @@ fn systemDeviceEnumerate(state: *architecture.CpuState) void {
     const sz = @sizeOf(danos.DeviceDescriptor);
     const cap = @min(maximum, (user_half_end - buffer_ptr) / sz); // clamp to the user half
     const out: [*]danos.DeviceDescriptor = @ptrFromInt(buffer_ptr);
-    architecture.setSystemCallResult(state, device_service.enumerate(out[0..@intCast(cap)]));
+    architecture.setSystemCallResult(state, devices_broker.enumerate(out[0..@intCast(cap)]));
 }
 
 /// device_claim(id) -> 0/-1: take exclusive ownership of a device for this process.
 fn systemDeviceClaim(state: *architecture.CpuState) void {
-    if (device_service.claim(architecture.systemCallArg(state, 0), scheduler.current().id))
+    if (devices_broker.claim(architecture.systemCallArg(state, 0), scheduler.current().id))
         architecture.setSystemCallResult(state, 0)
     else
         fail(state);
@@ -225,9 +225,9 @@ fn systemMmioMap(state: *architecture.CpuState) void {
     const resource_index = architecture.systemCallArg(state, 1);
     const t = scheduler.current();
     if (t.aspace == 0) return fail(state);
-    const owner = device_service.ownerOf(device_id) orelse return fail(state);
+    const owner = devices_broker.ownerOf(device_id) orelse return fail(state);
     if (owner != t.id) return fail(state); // not claimed by this process
-    const r = device_service.resourceOf(device_id, resource_index) orelse return fail(state);
+    const r = devices_broker.resourceOf(device_id, resource_index) orelse return fail(state);
     if (r.kind != @intFromEnum(danos.ResourceKind.memory)) return fail(state);
 
     if (t.device_map_next == 0) t.device_map_next = device_arena_base;
@@ -263,7 +263,7 @@ fn systemDeviceRegister(state: *architecture.CpuState) void {
     var descriptor: danos.DeviceDescriptor = undefined;
     if (!ipc.copyFromUser(t.aspace, descriptor_ptr, std.mem.asBytes(&descriptor))) return fail(state);
 
-    const id = device_service.register(parent_id, t.id, &descriptor) catch return fail(state);
+    const id = devices_broker.register(parent_id, t.id, &descriptor) catch return fail(state);
     architecture.setSystemCallResult(state, id);
 }
 
@@ -281,9 +281,9 @@ fn releaseIrqs(t: *scheduler.Task) void {
 /// by discovery. Neither a raw GSI nor an unclaimed device can get through — which
 /// is why irq_bind takes a resource index and not an interrupt number.
 fn ownedGsi(t: *scheduler.Task, device_id: u64, resource_index: u64) ?u32 {
-    const owner = device_service.ownerOf(device_id) orelse return null;
+    const owner = devices_broker.ownerOf(device_id) orelse return null;
     if (owner != t.id) return null;
-    const r = device_service.resourceOf(device_id, resource_index) orelse return null;
+    const r = devices_broker.resourceOf(device_id, resource_index) orelse return null;
     if (r.kind != @intFromEnum(danos.ResourceKind.irq)) return null;
     if (r.start >= irq.maximum_gsi) return null;
     return @intCast(r.start);