The application surface: enumerate, subscribe, and device-list (M18.3)

Applications ask the device manager for the tree (enumerate: a header
plus ChildEntry records) and subscribe to published add/remove events by
handing their endpoint over as the call's capability — the input-service
pattern; events are the same ChildAdded/ChildRemoved structs the bus
drivers send, one encoding in both directions. device-list is the first
client: it prints the tree, subscribes, and narrates the events through
a driver restart. The protocol's message maximum is capped at the
kernel's IPC MESSAGE_MAXIMUM (256 bytes, ten entries per reply; paging
joins the protocol when a tree outgrows one message). The startUserTask
debug print is gone: it wrote to serial unserialized against user-space
lines and sheared concurrent log markers in half — the root cause of the
scenario flakes.

docs/m17-m18-plan.md

@@ -58,7 +58,12 @@ only when its definition of green holds.
       register BAR — resource 0 is ECAM — reads CAPLENGTH/HCSPARAMS1, scans
       PORTSC, reports connected ports with speed-class identity; `usb-report`
       scenario proves report → prune → respawn → re-report; suite 53/53)
-- [ ] **M18.3** — app surface: enumerate/subscribe + device-list
+- [x] **M18.3** — app surface: enumerate/subscribe over IPC (subscriber
+      endpoint rides as the call's capability; events are the same structs the
+      buses send); device-list first client; protocol capped at the kernel's
+      IPC MESSAGE_MAXIMUM (256); the startUserTask debug print removed — it
+      sheared concurrent serial lines and was the scenario-flake root cause;
+      `device-list` scenario; suite 54/54)
 - [ ] **merge** `feat/usb-xhci-bus` → main, push — **loop ends here**
 
 ---