Rename the shared contract module danos -> system; QEMU logs to /var/log/system

The shared kernel<->user ABI contract (BootInformation, the SystemCall numbers,
DeviceDescriptor, page_size, ...) is now the `system` module at
system/system.zig, following the convention that a directory's root file takes
the directory's name.

One overlap to note: the runtime's syscall wrappers are already `runtime.system`,
so the single file that uses both the contract and those wrappers
(library/runtime/heap.zig) aliases the wrappers locally as `system_calls`. The
two are distinct (top-level `system` vs `runtime.system`); everywhere else the
contract is just `system`.

Also: the QEMU run's serial capture now lands in the FHS log location,
zig-out/var/log/system/serial0-<timestamp>.log — a stand-in for the kernel's own
logging system, which will eventually write there itself.

Suite 35/35 plus host tests green.

system/kernel/devices-broker.zig

@@ -20,7 +20,7 @@
 
 const std = @import("std");
 const platform = @import("platform");
-const danos = @import("danos"); 
+const system = @import("system"); 
 
 const maximum_devices = 64;
 
@@ -32,7 +32,7 @@ const maximum_devices = 64;
 /// `device_release` to reclaim on exit) is future work — see docs/driver-model.md.
 const maximum_children_per_parent = 16;
 
-var devices: [maximum_devices]danos.DeviceDescriptor = undefined;
+var devices: [maximum_devices]system.DeviceDescriptor = undefined;
 var claimed: [maximum_devices]?u32 = .{null} ** maximum_devices; // owner task id, or null
 var count: usize = 0;
 
@@ -46,13 +46,13 @@ pub fn init(device_tree: *const platform.DeviceTree) void {
     count = 0;
     dropped = 0;
     for (&claimed) |*c| c.* = null;
-    walk(device_tree.root, danos.no_parent);
+    walk(device_tree.root, system.no_parent);
 }
 
 /// Record `node` (unless it's the synthetic root) and recurse, threading the id we
 /// assigned it down to its children as their parent.
 fn walk(node: *platform.Device, parent_id: u64) void {
-    const id = if (node.class == .root) danos.no_parent else record(node, parent_id);
+    const id = if (node.class == .root) system.no_parent else record(node, parent_id);
     var child = node.first_child;
     while (child) |c| : (child = c.next_sibling) walk(c, id);
 }
@@ -60,16 +60,16 @@ fn walk(node: *platform.Device, parent_id: u64) void {
 fn record(node: *platform.Device, parent_id: u64) u64 {
     if (count >= maximum_devices) {
         dropped += 1;
-        return danos.no_parent; // children of a dropped node become roots, not orphans
+        return system.no_parent; // children of a dropped node become roots, not orphans
     }
-    var d = std.mem.zeroes(danos.DeviceDescriptor);
+    var d = std.mem.zeroes(system.DeviceDescriptor);
     d.id = count;
     d.parent = parent_id;
     d.class = @intFromEnum(node.class);
     const h = node.hid();
     d.hid_len = @min(h.len, d.hid.len);
     @memcpy(d.hid[0..d.hid_len], h[0..d.hid_len]);
-    const rc = @min(node.resource_count, danos.maximum_device_resources);
+    const rc = @min(node.resource_count, system.maximum_device_resources);
     d.resource_count = rc;
     for (0..rc) |i| {
         const r = node.resources[i];
@@ -82,7 +82,7 @@ fn record(node: *platform.Device, parent_id: u64) u64 {
 
 /// Copy up to `out.len` device descriptors into `out`; returns the total count
 /// available (which may exceed `out.len`).
-pub fn enumerate(out: []danos.DeviceDescriptor) usize {
+pub fn enumerate(out: []system.DeviceDescriptor) usize {
     const n = @min(count, out.len);
     @memcpy(out[0..n], devices[0..n]);
     return count;
@@ -104,7 +104,7 @@ pub fn ownerOf(id: u64) ?u32 {
 }
 
 /// Resource `index` of device `id`, or null if out of range.
-pub fn resourceOf(id: u64, index: u64) ?danos.ResourceDescriptor {
+pub fn resourceOf(id: u64, index: u64) ?system.ResourceDescriptor {
     if (id >= count) return null;
     const d = &devices[@intCast(id)];
     if (index >= d.resource_count) return null;
@@ -115,9 +115,9 @@ pub fn resourceOf(id: u64, index: u64) ?danos.ResourceDescriptor {
 /// interval containment; for an irq it's equality, since an interrupt line is not
 /// divisible. Zero-length child ranges are refused — an empty window is meaningless
 /// and would otherwise vacuously "fit" anywhere.
-fn contains(parent: danos.ResourceDescriptor, child: danos.ResourceDescriptor) bool {
+fn contains(parent: system.ResourceDescriptor, child: system.ResourceDescriptor) bool {
     if (parent.kind != child.kind) return false;
-    if (child.kind == @intFromEnum(danos.ResourceKind.irq)) return parent.start == child.start;
+    if (child.kind == @intFromEnum(system.ResourceKind.irq)) return parent.start == child.start;
     if (child.len == 0 or parent.len == 0) return false;
     // No overflow: a resource that wraps the address space is not containable.
     const child_end = std.math.add(u64, child.start, child.len) catch return false;
@@ -149,10 +149,10 @@ fn childCount(parent_id: u64) usize {
 /// `owner` must have claimed `parent_id`, and every resource in `descriptor` must be
 /// contained in a parent resource of the same kind. A device with no resources is
 /// fine and common: a USB device is addressed through its controller, not by MMIO.
-pub fn register(parent_id: u64, owner: u32, descriptor: *const danos.DeviceDescriptor) RegisterError!u64 {
+pub fn register(parent_id: u64, owner: u32, descriptor: *const system.DeviceDescriptor) RegisterError!u64 {
     const parent_owner = ownerOf(parent_id) orelse return error.BadParent;
     if (parent_owner != owner) return error.BadParent;
-    if (descriptor.resource_count > danos.maximum_device_resources) return error.TooManyResources;
+    if (descriptor.resource_count > system.maximum_device_resources) return error.TooManyResources;
     if (childCount(parent_id) >= maximum_children_per_parent) return error.TooManyChildren;
     if (count >= maximum_devices) return error.NoSpace;
 
@@ -166,7 +166,7 @@ pub fn register(parent_id: u64, owner: u32, descriptor: *const danos.DeviceDescr
         if (!ok) return error.NotContained;
     }
 
-    var d = std.mem.zeroes(danos.DeviceDescriptor);
+    var d = std.mem.zeroes(system.DeviceDescriptor);
     d.id = count;
     d.parent = parent_id;
     d.class = descriptor.class;