vfs: the root moves into the kernel — resolve + redirect cutover

runtime.fs now routes every path through fs_resolve: kernel-served
/system nodes are read via fs_node (tokens, no open state); everything
under a userspace mount goes straight to the owning backend's endpoint
with the kernel-rewritten mount-relative path — one syscall of naming,
then the unchanged vfs-protocol rendezvous, public API untouched. mkdir/
unlink/rename resolve-then-forward (rename checks both paths land on
the SAME backend); mount is the fs_mount syscall.

The fat server mounts twice — /mnt/usb from the volume root and /var
from its /var subtree — so the logger now writes the FHS path
/var/log/<boot-stamp>/... and swapping the persistent medium later
touches only fat's two mount calls. With clients holding fat's node ids
directly, fat records each handle's owner, checks it, and sweeps a dead
client's handles via the published exit events (the old router's
pattern, now where the state actually lives).

The userspace vfs server and its router die; ServiceId.vfs=1 stays
reserved-retired; protocol.zig moves to system/vfs-protocol.zig (the
wire contract is backend-only now). vfs-test becomes the ring-3 proof
of the kernel VFS (own-binary ELF magic through /system, read-only
refusals, listing); vfs-client-death becomes the fat sweep test over
the full storage chain, with a ring-scanning check (the last-write
buffer is too racy under a chattering tree).

system/services/vfs-test/vfs-test.zig

@@ -0,0 +1,89 @@
+//! /system/tests/vfs-test — a ring-3 client that proves the kernel VFS end to
+//! end through the plain `runtime.fs` API: resolve its OWN binary under the
+//! kernel-served /system mount, check its metadata, read its ELF magic, and
+//! list /system/services. On success it heartbeats "vfstest: ok" so the kernel
+//! test can observe it; on failure it reports what went wrong.
+//!
+//! The "park" role (the fat-client-death test): open a file on the FAT volume,
+//! then hold the handle forever without closing — the kill and the fat
+//! server's release-on-death sweep are the point.
+
+const std = @import("std");
+const runtime = @import("runtime");
+const fs = runtime.fs;
+
+pub fn main(init: runtime.process.Init) void {
+    if (init.arguments.count > 1) {
+        park();
+        return;
+    }
+
+    // Our own binary, resolved through the kernel mount table.
+    const self_path = "/system/tests/vfs-test";
+    var file = fs.open(self_path, .{}) orelse {
+        _ = runtime.system.write("vfstest: open of own binary failed\n");
+        return;
+    };
+    defer file.close();
+
+    const attributes = file.attributes() orelse {
+        _ = runtime.system.write("vfstest: attributes failed\n");
+        return;
+    };
+    if (attributes.kind != .regular or attributes.size == 0) {
+        _ = runtime.system.write("vfstest: bad attributes\n");
+        return;
+    }
+
+    var header: [4]u8 = undefined;
+    const n = file.read(&header) orelse 0;
+    if (n != 4 or header[0] != 0x7f or header[1] != 'E' or header[2] != 'L' or header[3] != 'F') {
+        _ = runtime.system.write("vfstest: ELF magic mismatch\n");
+        return;
+    }
+
+    // The write refusal: /system is read-only by construction.
+    if (file.write("x") != null or fs.open("/system/tests/new-file", .{ .create = true }) != null) {
+        _ = runtime.system.write("vfstest: /system accepted a write\n");
+        return;
+    }
+
+    // Listing: /system/services contains init.
+    var saw_init = false;
+    if (fs.openDirectory("/system/services")) |listing| {
+        var directory = listing;
+        defer directory.close();
+        var entry: fs.Entry = .{};
+        while (directory.next(&entry)) {
+            if (std.mem.eql(u8, entry.name(), "init")) saw_init = true;
+        }
+    }
+    if (!saw_init) {
+        _ = runtime.system.write("vfstest: /system/services listing missed init\n");
+        return;
+    }
+
+    while (true) {
+        _ = runtime.system.write("vfstest: ok\n");
+        runtime.system.sleep(1000);
+    }
+}
+
+fn park() void {
+    // The storage chain (usb -> block -> fat -> mounts) takes a few seconds;
+    // retry until the volume appears.
+    var parked: ?fs.File = null;
+    var tries: u32 = 0;
+    while (parked == null and tries < 1000) : (tries += 1) {
+        parked = fs.open("/mnt/usb/parked", .{ .create = true });
+        if (parked == null) runtime.system.sleep(20);
+    }
+    if (parked == null) {
+        _ = runtime.system.write("vfstest: park open failed\n");
+        return;
+    }
+    while (true) {
+        _ = runtime.system.write("vfstest: parked\n");
+        runtime.system.sleep(500);
+    }
+}