kernel: the device rides system_spawn, so a driver never runs without it

Delegation moves out of onHello and into the spawn itself. The manager holds
the hardware and names it in the call that creates the driver; the kernel
checks the device is the caller's to give, then hands it over as part of
making the child.

The reason is the window. A transfer after spawning always leaves an
interval in which the child is running and does not yet hold its device. It
would close on QEMU every time and open occasionally on a machine with
different core counts and timing — the exact failure shape this track exists
to delete, and not one worth introducing while removing the others. Fused
into the spawn there is no interval: the child does not exist until it holds
the device.

Ownership is checked BEFORE the child is created, so a refusal leaves
nothing running rather than a driver without the hardware it was spawned
for. The IOMMU confinement moves with the device, as it does on the transfer
path. systemCall6 is added for the sixth argument; r9 was free, and abi
gains a no_device sentinel matching the protocol's.

No driver had to change to receive a device, which is what makes this
better than requiring every driver to hello: ps2-bus keeps its legacy
status, and discovery — which has no assignment at all, since it is what
produces the device tree — is unaffected.

The attacker fixture now tries the spawn as a back door: name someone else's
device, and both the spawn and any child must be refused. Verifying that
assertion exposed a bug in the fixture itself. The kernel case's pass marker
was "device-authority: ok", which matches the FIRST per-assertion line, so
its wait loop exited before any failure was printed — the case would have
passed with failures in it, and had been able to since D2. The verdict lines
now carry a distinct VERDICT prefix, and with the ownership check removed
the case genuinely fails. A green test that cannot go red is worse than no
test.

Suite 118/118.

test/system/services/device-authority-test/device-authority-test.zig

@@ -43,6 +43,7 @@ fn line(comptime format: []const u8, arguments: anytype) void {
 }
 
 var failures: usize = 0;
+var process_table: [64]process.ProcessDescriptor = undefined;
 
 fn check(name: []const u8, ok: bool) void {
     if (!ok) failures += 1;
@@ -74,10 +75,22 @@ fn run() void {
     const absent = if (device.transfer(0xFFFF_FFFF, process.taskId())) |_| false else |e| e == error.NoSuchDevice;
     check("a device that does not exist is refused as absent", absent);
 
+    // 4. **The spawn is not a second way in.** A device now rides system_spawn, which
+    //    would be a fine back door if the kernel checked ownership any less carefully
+    //    there than it does in transfer: spawn a child, name someone else's device, and
+    //    the child holds hardware nobody gave it. The refusal must happen before the
+    //    child exists, so nothing is left running either.
+    if (seen != 0) {
+        const before = process.processes(&process_table);
+        const spawned = process.spawnSupervisedWithDevice("/test/system/services/device-authority-test", &.{}, null, table[0].id);
+        check("spawning with a device the caller does not hold is refused", spawned == null);
+        check("and no child was left behind by the refusal", process.processes(&process_table) == before);
+    }
+
     if (failures == 0) {
-        line("device-authority: ok ({d} devices, none of them mine)\n", .{seen});
+        line("device-authority: VERDICT ok ({d} devices, none of them mine)\n", .{seen});
     } else {
-        line("device-authority: FAILED {d} assertion(s)\n", .{failures});
+        line("device-authority: VERDICT FAILED {d} assertion(s)\n", .{failures});
     }
 }