Rename the shared contract module danos -> system; QEMU logs to /var/log/system

The shared kernel<->user ABI contract (BootInformation, the SystemCall numbers,
DeviceDescriptor, page_size, ...) is now the `system` module at
system/system.zig, following the convention that a directory's root file takes
the directory's name.

One overlap to note: the runtime's syscall wrappers are already `runtime.system`,
so the single file that uses both the contract and those wrappers
(library/runtime/heap.zig) aliases the wrappers locally as `system_calls`. The
two are distinct (top-level `system` vs `runtime.system`); everywhere else the
contract is just `system`.

Also: the QEMU run's serial capture now lands in the FHS log location,
zig-out/var/log/system/serial0-<timestamp>.log — a stand-in for the kernel's own
logging system, which will eventually write there itself.

Suite 35/35 plus host tests green.

library/runtime/ipc.zig

@@ -3,7 +3,7 @@
 //! reached this way. The server side (`replyWait`, which returns two values) is
 //! added with the first server binary.
 
-const danos = @import("danos");
+const system = @import("system");
 const sc = @import("system-call.zig");
 
 /// A small-int handle into the calling process's handle table.
@@ -30,13 +30,13 @@ pub fn createEndpoint() ?Handle {
 }
 
 /// Publish endpoint `h` under a well-known service id so other processes find it.
-pub fn register(id: danos.ServiceId, h: Handle) bool {
+pub fn register(id: system.ServiceId, h: Handle) bool {
     return !failed(sc.systemCall2(.ipc_register, @intFromEnum(id), h));
 }
 
 /// Find the endpoint published under `id`, installing a handle to it in this
 /// process.
-pub fn lookup(id: danos.ServiceId) ?Handle {
+pub fn lookup(id: system.ServiceId) ?Handle {
     const r = sc.systemCall1(.ipc_lookup, @intFromEnum(id));
     return if (failed(r)) null else r;
 }
@@ -53,7 +53,7 @@ pub fn call(h: Handle, message: []const u8, reply: []u8) CallError!usize {
 /// Set in `Received.badge` when what arrived is an asynchronous notification — a
 /// bound device interrupt — rather than a client's message. The low bits carry the
 /// GSI. See `isNotification`.
-pub const notify_badge_bit: u64 = danos.notify_badge_bit;
+pub const notify_badge_bit: u64 = system.notify_badge_bit;
 
 /// The result of a `replyWait`: the request length and the sender's badge (a
 /// task id, or an IRQ notification if the high bit is set).
@@ -84,7 +84,7 @@ pub fn replyWait(h: Handle, reply: []const u8, receive: []u8) Received {
     asm volatile ("syscall"
         : [rax] "={rax}" (rax),
           [rdx] "+{rdx}" (rdx),
-        : [n] "{rax}" (@intFromEnum(danos.SystemCall.ipc_reply_wait)),
+        : [n] "{rax}" (@intFromEnum(system.SystemCall.ipc_reply_wait)),
           [a0] "{rdi}" (h),
           [a1] "{rsi}" (@intFromPtr(reply.ptr)),
           [a3] "{r10}" (@intFromPtr(receive.ptr)),