M2 step 4: relink the kernel into the higher half

The kernel now links at 0xFFFF_FFFF_8000_0000 (code_model .kernel) and
loads low via the linker script's AT() clauses (.text at 1 MiB). A new
asm _start installs a 64 KiB kernel-owned .bss stack — the loader stack
is a low address that goes away with the identity map — and calls the
Zig entry, which reaches boot_info through the physmap. The user-pf test
blob reads the LAPIC through the physmap window (still present|user, ec
0x5). The low identity map still coexists in the kernel's tables as the
safety net. Suite 27/27.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

build.zig

@@ -121,7 +121,7 @@ pub fn build(b: *std.Build) void {
             .root_source_file = b.path("src/kernel/main.zig"),
             .target = kernel_target,
             .optimize = optimize,
-            .code_model = .small, // kernel is linked in the low 2 GiB (see image_base)
+            .code_model = .kernel, // kernel runs in the top 2 GiB (higher half)
             .red_zone = false, // interrupts would corrupt the SysV red zone
             .single_threaded = false, // SMP: the big kernel lock's atomics must be real across cores
             .sanitize_c = .off, // the UBSan runtime needs f128/SSE support we don't provide
@@ -139,14 +139,14 @@ pub fn build(b: *std.Build) void {
     exe.setLinkerScript(b.path("src/kernel/arch/x86_64/linker.ld"));
     exe.entry = .{ .symbol_name = "_start" };
     // The self-hosted linker ignores parts of the linker script (PHDRS,
-    // /DISCARD/, section order); the higher-half layout depends on the script
-    // being authoritative, so pin the kernel to LLVM + LLD.
+    // /DISCARD/, AT(), section order); the higher-half layout depends on the
+    // script being authoritative, so pin the kernel to LLVM + LLD.
     exe.use_llvm = true;
     exe.use_lld = true;
-    // Physical address the bootloader loads the kernel to (identity-mapped under
-    // UEFI). Overrides Zig's default image base so the linker script's layout is
-    // honoured; adjust here if it collides with firmware-reserved memory.
-    exe.image_base = 0x100000; // 1 MiB
+    // Higher-half virtual base (matches KERNEL_VIRT_BASE in linker.ld); the
+    // linker's AT() clauses give each segment a low physical load address
+    // (.text at 1 MiB), which the loader allocates and copies into.
+    exe.image_base = 0xFFFFFFFF80100000;
 
     b.installArtifact(exe);