iommu: enable Intel VT-d translation with per-claim device confinement

First enforcement step of the IOVA track. A vendor-neutral IOMMU core
(iommu.zig) drives an Intel VT-d backend (iommu-intel.zig) to give DMA a
real translation layer instead of the fail-open free-for-all M16 left.

- Boot posture is now stated explicitly: "iommu online (Intel VT-d)"
  with version/agaw/rmrr, or "none present - DMA fail-open (unisolated)".
- DMAR parsing extended to select the INCLUDE_PCI_ALL unit (real Intel
  PCs put an iGPU-scoped unit first) and record single-path-endpoint
  RMRRs; multi-hop scopes and extra DRHDs are counted and warned, never
  silently dropped.
- Translation is enabled at boot into a blanket identity domain (all RAM
  + RMRRs, 2 MiB leaves). PCI functions are enumerated post-boot by the
  ring-3 pci-bus driver, so a device is attached to the domain when its
  driver claims it (confineDevice, with claim rollback if confinement
  fails) and detached on driver death, before broker release and DMA
  frame teardown. Unclaimed devices are non-present: their DMA faults.
- Interrupt remapping stays off, so MSI writes to 0xFEE00000 bypass
  translation and the interrupt-driven xHC keeps working.
- devices-broker gains pciAddressOf (derives BDF from the config-space
  ECAM offset), unclaim, and forEachPciFunction.

Faults are drained and logged rate-limited as DANOS-IOMMU-FAULT.

Cases: iommu extended (translation on, scratch-domain map/resolve/unmap,
zero idle faults); new iommu-usb-storage and iommu-usb-hid run the full
storage + input stacks through translated DMA with MSI intact. 103/103.

test/qemu_test.py

@@ -146,20 +146,44 @@ CASES = [
      "fail":   r"DANOS-TEST-RESULT: FAIL"},
     # DMA memory (M14): contiguous frame allocation, below-4G cap, coherent mapping,
     # and reclaim on teardown.
+    # Boots with no IOMMU device, so it also asserts the explicit fail-open boot line
+    # (the DMA-isolation posture must be stated, never silent).
     {"name": "dma",
-     "expect": r"DANOS-TEST-RESULT: PASS",
+     "expect": r"(?s)(?=.*iommu      : none present - DMA fail-open \(unisolated\))(?=.*DANOS-TEST-RESULT: PASS)",
      "fail":   r"DANOS-TEST-RESULT: FAIL"},
     # MSI (M15): allocate a per-device vector and deliver it as a notification (a
     # self-IPI stands in for the device's MSI write, since the HPET has no MSI).
     {"name": "msi",
      "expect": r"DANOS-TEST-RESULT: PASS",
      "fail":   r"DANOS-TEST-RESULT: FAIL"},
-    # IOMMU (M16): boot with an emulated VT-d unit and confirm danos parses the DMAR
-    # table and reads the unit's registers. Detection only — enforcement is future.
+    # IOMMU: boot with an emulated VT-d unit; danos parses the DMAR table, enables
+    # translation, and proves the domain walker (map/resolve/unmap on a scratch domain)
+    # with no spurious faults. The `enabled` line is a lookahead so a silently-dead unit
+    # cannot fake a pass.
     {"name": "iommu",
      "qemu_extra": ["-device", "intel-iommu,intremap=off"],
-     "expect": r"DANOS-TEST-RESULT: PASS",
-     "fail":   r"DANOS-TEST-RESULT: FAIL"},
+     "expect": r"(?s)(?=.*DANOS-IOMMU: enabled base=0x[0-9a-f]+ domains active)(?=.*DANOS-TEST-RESULT: PASS)",
+     "fail":   r"DANOS-TEST-RESULT: FAIL|DANOS-IOMMU-FAULT"},
+    # DMA under translation: the full USB storage stack (xHC ring DMA + BOT/SCSI + fat's
+    # cross-process bounce buffer) runs with VT-d enabled. Every device is identity-
+    # mapped in the blanket domain, so DMA works, but through real second-level walks.
+    {"name": "iommu-usb-storage",
+     "build_case": "fat-mount",
+     "smp":    4,
+     "timeout": 150,
+     "qemu_extra": ["-device", "intel-iommu,intremap=off"],
+     "expect": r"(?s)(?=.*/system/kernel: iommu online)(?=.*fat: mounted /mnt/usb)(?=.*fat-test: ok)",
+     "fail":   r"DANOS-TEST-RESULT: FAIL|DANOS-IOMMU-FAULT"},
+    # DMA + MSI under translation: interrupt-IN reports arrive through translated DMA and
+    # the xHC's MSI/MSI-X still delivers (the 0xFEE00000 interrupt window bypasses second-
+    # level translation with interrupt remapping off).
+    {"name": "iommu-usb-hid",
+     "build_case": "usb-hid",
+     "smp":    4,
+     "timeout": 150,
+     "qemu_extra": ["-device", "intel-iommu,intremap=off"],
+     "expect": r"(?s)(?=.*/system/kernel: iommu online)(?=.*usb-hid-keyboard: ok)(?=.*usb-hid-mouse: ok)",
+     "fail":   r"DANOS-TEST-RESULT: FAIL|DANOS-IOMMU-FAULT"},
     # Port I/O grants: a claimed device's io_port resource lets a driver read/write its
     # ports (PS/2 status 0x64), gated by the claim; out-of-range/unclaimed is refused.
     {"name": "ioport",