display: layer stack + damage-driven compositor (D3)

Turn the service into a real compositor. A layer is a server-owned surface (its
own mmap'd cacheable buffer) with a screen position, z-order, and visibility.
Clients create layers, draw into them by command, mark damage, and present; the
compositor repaints only the damaged region — clear to the wallpaper, paint the
visible layers bottom-to-top (z-sorted), flush that rectangle back -> front (WC).

- compositor.zig: the pure, host-tested core — Rect (intersect/unite), Surface,
  fillRect, composite (opaque, clipped to a damage rect), blitTile (unaligned-
  safe read of a client tile). No syscall/runtime dependency.
- protocol.zig: pack(format, r, g, b) — native pixel encoding for rgbx/bgrx, the
  shared colour vocabulary of client and server. Host-tested.
- display.zig: the layer table + create/configure/destroy/fill_rect/blit_tile/
  damage/present ops wired onto the compositor, plus a damage-accumulating present.
- Startup self-check: two overlapping layers composited on the real framebuffer,
  read back to confirm the overlap shows the top layer and outside shows the
  bottom — logs `display: compositor self-check ok`.

Gate: `zig build test` green (compositor + pack), and the display-service case's
self-check passes on hardware. Both new pure modules added to the test loop.

test/qemu_test.py

@@ -171,13 +171,13 @@ CASES = [
     {"name": "display",
      "expect": r"DANOS-TEST-RESULT: PASS",
      "fail":   r"DANOS-TEST-RESULT: FAIL"},
-    # Display service (D2): the user-space compositor claims the framebuffer, allocates a
-    # cacheable back buffer, clears it, and presents that composed frame — proving the
-    # double-buffer path. Matched on the service's own heartbeats (it prints them only
-    # after the whole claim -> map(WC) -> back-buffer -> present chain succeeds).
+    # Display service (D2/D3): the user-space compositor claims the framebuffer, allocates
+    # a cacheable back buffer, clears it, and presents that composed frame (double-buffer
+    # path); then a startup self-check composites two overlapping layers and confirms the
+    # overlap shows the top layer (D3). Matched on the service's own heartbeats.
     {"name": "display-service",
-     "expect": r"display: online \d+x\d+ pitch \d+[\s\S]*display: presented frame 0",
-     "fail":   r"display: could not|CPU EXCEPTION|KERNEL PANIC"},
+     "expect": r"display: online \d+x\d+ pitch \d+[\s\S]*display: presented frame 0[\s\S]*display: compositor self-check ok",
+     "fail":   r"display: could not|self-check FAILED|CPU EXCEPTION|KERNEL PANIC"},
     # Monotonic clock (clock() syscall source): calibrated, advancing, never backwards.
     {"name": "clock",
      "expect": r"DANOS-TEST-RESULT: PASS",