kernel: the device rides system_spawn, so a driver never runs without it

Delegation moves out of onHello and into the spawn itself. The manager holds
the hardware and names it in the call that creates the driver; the kernel
checks the device is the caller's to give, then hands it over as part of
making the child.

The reason is the window. A transfer after spawning always leaves an
interval in which the child is running and does not yet hold its device. It
would close on QEMU every time and open occasionally on a machine with
different core counts and timing — the exact failure shape this track exists
to delete, and not one worth introducing while removing the others. Fused
into the spawn there is no interval: the child does not exist until it holds
the device.

Ownership is checked BEFORE the child is created, so a refusal leaves
nothing running rather than a driver without the hardware it was spawned
for. The IOMMU confinement moves with the device, as it does on the transfer
path. systemCall6 is added for the sixth argument; r9 was free, and abi
gains a no_device sentinel matching the protocol's.

No driver had to change to receive a device, which is what makes this
better than requiring every driver to hello: ps2-bus keeps its legacy
status, and discovery — which has no assignment at all, since it is what
produces the device tree — is unaffected.

The attacker fixture now tries the spawn as a back door: name someone else's
device, and both the spawn and any child must be refused. Verifying that
assertion exposed a bug in the fixture itself. The kernel case's pass marker
was "device-authority: ok", which matches the FIRST per-assertion line, so
its wait loop exited before any failure was printed — the case would have
passed with failures in it, and had been able to since D2. The verdict lines
now carry a distinct VERDICT prefix, and with the ownership check removed
the case genuinely fails. A green test that cannot go red is worse than no
test.

Suite 118/118.

system/kernel/tests.zig

@@ -4257,8 +4257,12 @@ fn deviceAuthorityTest(boot_information: *const BootInformation) void {
     process.setInitialRamdisk(image);
     check("device-authority-test spawned", spawnNamedWithArg(rd, "device-authority-test", "run"));
 
-    const pass_marker = "device-authority: ok";
-    const fail_marker = "device-authority: FAIL";
+    // The VERDICT prefix matters: the fixture prints one "device-authority: ok <name>"
+    // line per assertion, so a marker of "device-authority: ok" matches the FIRST
+    // passing assertion and this loop exits before any later failure is printed — the
+    // case then passes with failures in it, which it did until this was caught.
+    const pass_marker = "device-authority: VERDICT ok";
+    const fail_marker = "device-authority: VERDICT FAILED";
     scheduler.setPriority(1);
     const deadline = architecture.millis() + 20000;
     var saw_pass = false;