Rename the shared contract module danos -> system; QEMU logs to /var/log/system

The shared kernel<->user ABI contract (BootInformation, the SystemCall numbers,
DeviceDescriptor, page_size, ...) is now the `system` module at
system/system.zig, following the convention that a directory's root file takes
the directory's name.

One overlap to note: the runtime's syscall wrappers are already `runtime.system`,
so the single file that uses both the contract and those wrappers
(library/runtime/heap.zig) aliases the wrappers locally as `system_calls`. The
two are distinct (top-level `system` vs `runtime.system`); everywhere else the
contract is just `system`.

Also: the QEMU run's serial capture now lands in the FHS log location,
zig-out/var/log/system/serial0-<timestamp>.log — a stand-in for the kernel's own
logging system, which will eventually write there itself.

Suite 35/35 plus host tests green.

docs/smp.md

@@ -203,7 +203,7 @@ next lands.
   [scheduling.md](scheduling.md#affinity-pinning-a-task-to-a-core)). The `affinity`
   test confirms a pinned task never migrates. This is the mechanism the fault-on-AP
   test rides on, and the *explicit-affinity* real-time-predictable model.
-- **Right-sized footprint** — the per-CPU ceiling (`danos.max_cpus`, one constant
+- **Right-sized footprint** — the per-CPU ceiling (`system.max_cpus`, one constant
   shared by discovery, the scheduler, and the per-core GDT/TSS) is generous (128), but
   the *large* per-core resources — the kernel and IST (double-fault) stacks — are
   **heap-allocated at bring-up**, only for cores that actually come online. Only the