reorg: move test fixtures to test/system/services (source + boot volume)

The 11 QEMU-suite fixtures lived mixed into system/services/ with their
binaries bundled at /system/tests/<name>. Now the repo path is the boot
path, like every real service: test/system/services/<name>. fat-test
moves out of the fat server's directory into its own; display-demo
stays a boot service.

- kernel VFS: setInitialRamdisk derives one read-only initrd mount per
  top-level tree named by the ramdisk entry paths (/system, /test),
  registers ancestors generically with self-parented roots, and refuses
  backend shadowing of any initrd tree
- EFI loader: the fallback walk also enumerates \test (optional — a
  volume without fixtures still boots); manifest and capsule unchanged
- path literals: vfs-test self-open + create probe, process-test
  process_enumerate matches, the args-echo argv[0] expectation; the
  kvfs case now covers the /test root end to end
- docs: DFHS /test rows, tree diagrams, loader prose, and the location
  convention gain the third home; fixed the input-source link

100/100 QEMU cases pass.

test/system/services/shared-memory-client/shared-memory-client.zig

@@ -0,0 +1,46 @@
+//! test/system/services/shared-memory-client — the creating half of the shared-memory test (docs/display-v2.md V2).
+//! It `shared_memory_create`s a shared region, writes a known pattern into it, and hands the region's
+//! capability to `shared-memory-server` as an `ipc_call` send_cap. The server maps that capability and
+//! confirms the pattern is visible — proving cross-process shared memory over the extended
+//! capability-passing path.
+
+
+const ipc = @import("ipc");
+const time = @import("time");
+const memory = @import("memory");
+const logging = @import("logging");
+const pattern_len = 4096;
+
+/// The pattern the server checks — must match shared-memory-server.zig.
+fn expected(i: usize) u8 {
+    return @truncate(i *% 7 +% 3);
+}
+
+fn lookupServer() ?ipc.Handle {
+    var attempts: usize = 0;
+    while (attempts < 100) : (attempts += 1) {
+        if (ipc.lookup(.shared_memory_test)) |h| return h;
+        time.sleepMillis(50);
+    }
+    return null;
+}
+
+pub fn main() void {
+    const region = memory.sharedCreate(pattern_len) orelse {
+        _ = logging.write("shared-memory: create failed\n");
+        return;
+    };
+    var i: usize = 0;
+    while (i < pattern_len) : (i += 1) region.ptr[i] = expected(i);
+
+    const server = lookupServer() orelse {
+        _ = logging.write("shared-memory: no server\n");
+        return;
+    };
+    // A non-empty message (so it reaches on_message, not the ping path), carrying the shared-memory
+    // region's capability. The reply is empty; we just need the round trip.
+    var reply: [64]u8 = undefined;
+    _ = ipc.callCap(server, "shared-memory", &reply, region.handle) catch {
+        _ = logging.write("shared-memory: call failed\n");
+    };
+}