reorg: move test fixtures to test/system/services (source + boot volume)

The 11 QEMU-suite fixtures lived mixed into system/services/ with their
binaries bundled at /system/tests/<name>. Now the repo path is the boot
path, like every real service: test/system/services/<name>. fat-test
moves out of the fat server's directory into its own; display-demo
stays a boot service.

- kernel VFS: setInitialRamdisk derives one read-only initrd mount per
  top-level tree named by the ramdisk entry paths (/system, /test),
  registers ancestors generically with self-parented roots, and refuses
  backend shadowing of any initrd tree
- EFI loader: the fallback walk also enumerates \test (optional — a
  volume without fixtures still boots); manifest and capsule unchanged
- path literals: vfs-test self-open + create probe, process-test
  process_enumerate matches, the args-echo argv[0] expectation; the
  kvfs case now covers the /test root end to end
- docs: DFHS /test rows, tree diagrams, loader prose, and the location
  convention gain the third home; fixed the input-source link

100/100 QEMU cases pass.

docs/system-requirements.md

@@ -119,8 +119,9 @@ hypervisor configured for UEFI firmware and an xHCI USB controller.
 - The loader reads `/system/kernel` off the FAT boot volume, then loads user
   space: a prebuilt `boot\system.img` capsule
   ([system-image.md](system-image.md)) when present, otherwise it walks
-  the volume's `/system` tree (init included) into the initial ramdisk. The
-  kernel can boot "kernel-only" without either. (`efi.zig:16`, `efi.zig:68`)
+  the volume's `/system` and optional `/test` trees (init included) into the
+  initial ramdisk. The kernel can boot "kernel-only" without either.
+  (`efi.zig:16`, `efi.zig:68`)
 
 ## Interrupt controller