Rename the shared contract module danos -> system; QEMU logs to /var/log/system

The shared kernel<->user ABI contract (BootInformation, the SystemCall numbers,
DeviceDescriptor, page_size, ...) is now the `system` module at
system/system.zig, following the convention that a directory's root file takes
the directory's name.

One overlap to note: the runtime's syscall wrappers are already `runtime.system`,
so the single file that uses both the contract and those wrappers
(library/runtime/heap.zig) aliases the wrappers locally as `system_calls`. The
two are distinct (top-level `system` vs `runtime.system`); everywhere else the
contract is just `system`.

Also: the QEMU run's serial capture now lands in the FHS log location,
zig-out/var/log/system/serial0-<timestamp>.log — a stand-in for the kernel's own
logging system, which will eventually write there itself.

Suite 35/35 plus host tests green.

library/runtime/system.zig

@@ -1,15 +1,15 @@
 //! Typed system_call surface for user space — thin wrappers over the raw `system_call`
-//! stubs, one per kernel call. Numbers come from `danos.SystemCall`, the single
+//! stubs, one per kernel call. Numbers come from `system.SystemCall`, the single
 //! source of truth shared with the kernel dispatcher.
 
-const danos = @import("danos");
+const system = @import("system");
 const sc = @import("system-call.zig");
 
 /// `mmap` protection flags (matching the usual C bit values). Grants are always
 /// readable+writable today; the kernel does not yet honour finer prot.
-pub const PROT_READ: usize = danos.prot_read;
-pub const PROT_WRITE: usize = danos.prot_write;
-pub const PROT_EXEC: usize = danos.prot_exec;
+pub const PROT_READ: usize = system.prot_read;
+pub const PROT_WRITE: usize = system.prot_write;
+pub const PROT_EXEC: usize = system.prot_exec;
 
 /// Give up the rest of this quantum.
 pub fn yield() void {