reorg: move test fixtures to test/system/services (source + boot volume)

The 11 QEMU-suite fixtures lived mixed into system/services/ with their
binaries bundled at /system/tests/<name>. Now the repo path is the boot
path, like every real service: test/system/services/<name>. fat-test
moves out of the fat server's directory into its own; display-demo
stays a boot service.

- kernel VFS: setInitialRamdisk derives one read-only initrd mount per
  top-level tree named by the ramdisk entry paths (/system, /test),
  registers ancestors generically with self-parented roots, and refuses
  backend shadowing of any initrd tree
- EFI loader: the fallback walk also enumerates \test (optional — a
  volume without fixtures still boots); manifest and capsule unchanged
- path literals: vfs-test self-open + create probe, process-test
  process_enumerate matches, the args-echo argv[0] expectation; the
  kvfs case now covers the /test root end to end
- docs: DFHS /test rows, tree diagrams, loader prose, and the location
  convention gain the third home; fixed the input-source link

100/100 QEMU cases pass.

docs/README.md

@@ -220,6 +220,7 @@ addressed as **`system/services/init`** — the repeated leaf resolves away:
 |----------------------------------------|--------------------------------------------|
 | `system/services/init/init.zig`        | `system/services/init` → `/system/services/init` |
 | `system/drivers/ps2-bus/ps2-bus.zig`   | `system/drivers/ps2-bus` → `/system/drivers/ps2-bus` |
+| `test/system/services/vfs-test/vfs-test.zig` | `test/system/services/vfs-test` → `/test/system/services/vfs-test` |
 | `library/device/pci/pci.zig`           | `library/device/pci` (the `pci` module)          |
 
 In **source**, a sub-project is a directory so it can hold many files — the entry is
@@ -258,7 +259,11 @@ library/         → /lib       libraries, one sub-directory each
   protocol/                   driver↔service wire contracts (vfs block display scanout input
                               power device-manager usb-transfer), one module per directory
 boot/            → /boot      the loaders
-tools/  test/                 host-side build + QEMU test harness
+test/            → /test      the test tree: the QEMU harness (qemu_test.py, host-side)
+  system/services/            beside the on-image test fixtures — vfs-test/ thread-test/
+                              crash-test/ … — whose repo path IS their boot-volume path
+                              (/test/system/services/<name>)
+tools/                        host-side build scripts
 ```
 
 **Wire protocols live in `library/protocol/`**, one module per directory
@@ -314,5 +319,6 @@ exception in [coding-standards.md](coding-standards.md) applies to that seam.
 | Service clients (a program's view of a service) and device clients | `library/client/` (display, input), `library/device/driver` |
 | System services (init, the `fat` filesystem, the device-manager) | `system/services/` |
 | Device drivers, one sub-project each (`pci-bus`, `ps2-bus`, `usb-xhci-bus` bus drivers) | `system/drivers/` |
+| On-image test fixtures for the QEMU cases (`vfs-test`, `crash-test`, `thread-test`, …) → `/test/system/services` | `test/system/services/` |
 | Build + `run-x86-64` (QEMU/OVMF) + `release-x86-64` (the flashable ISO) | `build.zig` |
 | QEMU integration test harness | `test/qemu_test.py` |