Rename the shared contract module danos -> system; QEMU logs to /var/log/system

The shared kernel<->user ABI contract (BootInformation, the SystemCall numbers,
DeviceDescriptor, page_size, ...) is now the `system` module at
system/system.zig, following the convention that a directory's root file takes
the directory's name.

One overlap to note: the runtime's syscall wrappers are already `runtime.system`,
so the single file that uses both the contract and those wrappers
(library/runtime/heap.zig) aliases the wrappers locally as `system_calls`. The
two are distinct (top-level `system` vs `runtime.system`); everywhere else the
contract is just `system`.

Also: the QEMU run's serial capture now lands in the FHS log location,
zig-out/var/log/system/serial0-<timestamp>.log — a stand-in for the kernel's own
logging system, which will eventually write there itself.

Suite 35/35 plus host tests green.

system/kernel/pmm.zig

@@ -2,14 +2,14 @@
 //! 4 KiB physical frames — the primitive every later memory feature (page
 //! tables, the heap) is built on top of.
 //!
-//! This is generic kernel code: it works on the neutral `danos.MemoryRegion`
+//! This is generic kernel code: it works on the neutral `system.MemoryRegion`
 //! array the loader hands over (see docs/memory-map.md), so it carries no UEFI
 //! and nothing architecture-specific beyond the 4 KiB page.
 
 const std = @import("std");
-const danos = @import("danos");
+const system = @import("system");
 
-const page_size = danos.page_size;
+const page_size = system.page_size;
 
 /// One bit per frame, covering physical RAM from 0 up to the highest usable
 /// address: 1 = used/unavailable, 0 = free. The bitmap itself lives in a frame
@@ -48,8 +48,8 @@ inline fn setFree(frame: usize) void {
     bitmap[frame >> 3] &= ~(@as(u8, 1) << bit(frame));
 }
 
-fn regions(map: danos.MemoryMap) []const danos.MemoryRegion {
-    return @as([*]const danos.MemoryRegion, @ptrFromInt(danos.physicalToVirtual(map.regions)))[0..map.len];
+fn regions(map: system.MemoryMap) []const system.MemoryRegion {
+    return @as([*]const system.MemoryRegion, @ptrFromInt(system.physicalToVirtual(map.regions)))[0..map.len];
 }
 
 /// Build the allocator from the loader's memory map. Reaches physical memory
@@ -59,7 +59,7 @@ fn regions(map: danos.MemoryMap) []const danos.MemoryRegion {
 /// region (lowest address), which must sit under the bootstrap physmap's reach
 /// (4 GiB); it always does, as both this and the page-table allocator scan from
 /// low addresses up.
-pub fn init(map: danos.MemoryMap) void {
+pub fn init(map: system.MemoryMap) void {
     const regs = regions(map);
 
     // 1. Size the bitmap to cover every frame up to the highest RAM address —
@@ -91,7 +91,7 @@ pub fn init(map: danos.MemoryMap) void {
         }
     }
     const bitmap_base = storage orelse @panic("pmm: no region large enough for the frame bitmap");
-    bitmap = @as([*]u8, @ptrFromInt(danos.physicalToVirtual(bitmap_base)))[0..bitmap_bytes];
+    bitmap = @as([*]u8, @ptrFromInt(system.physicalToVirtual(bitmap_base)))[0..bitmap_bytes];
 
     // 3. Start with everything marked used, then free the usable regions. Doing
     //    it this way means every gap, reserved span and MMIO hole is unallocatable