feat: proper IPC-based boot — init loads servers from storage via IPC, VirtIO GPU driver

Complete microkernel boot pipeline: adapter loads only init + storage + display
from disk. Init bootstraps all other servers by reading binaries from the
storage server via IPC, parsing ELF, creating processes, mapping pages, and
spawning threads.

New syscalls:
- CreateEndpoint: userspace endpoint creation with full capability grant
- DebugPutchar: debug output to UART from userspace
- MapPage: cross-process page mapping (init loads binaries into children)
- SpawnThreadIn: spawn thread in another process via capability

Key fixes:
- Per-process L1 page tables for VPN[2]=0 (prevents cross-process corruption)
- Separate kernel_pt from page_tables[0] (init pid=0 overwrote kernel PT ref)
- Thread Running state set in switch_to_next (syscalls rejected without it)
- Pending IPC results applied during context switch
- SIE disabled during boot (timer can't preempt into unready processes)
- User heap VA starts at 0x40000 (avoids shared buffer at 0x30000)
- RequestPages maps at user VAs via per-process heap allocator

VirtIO GPU:
- Adapter probes for GPU device, initializes resource/scanout/backing
- Display server writes to mapped framebuffer, flushes via GPU virtqueue
- 640x480 BGRA framebuffer with transfer-to-host and resource-flush

Storage server:
- Userspace VirtIO block driver using pre-mapped MMIO and DMA pages
- FAT16 filesystem reader serving file-read requests via IPC
- Shared buffer protocol: init writes filename, storage writes file data

Echo app for IPC testing (adapter-loaded echo proved the pipeline end-to-end).

crates/kernel/src/syscall/lifecycle.rs

@@ -70,6 +70,53 @@ impl<P: Platform> Kernel<P> {
         SyscallOutcome::Complete(SyscallResult::Slot(slot))
     }
 
+    pub(crate) fn handle_spawn_thread_in(
+        &mut self,
+        caller_pid: types::id::ProcessId,
+        process_cap: types::bounded::CapSlot,
+        entry: types::address::EntryPoint,
+        stack: types::address::StackPointer,
+    ) -> SyscallOutcome {
+        use domain::scheduler::Scheduler;
+        use domain::thread::SavedContext;
+
+        let target_pid = match self.check_cap(
+            caller_pid,
+            process_cap,
+            types::permission::Permission::Execute,
+        ) {
+            Ok(cap) => match cap.resource() {
+                domain::resource::Resource::Process(pid) => *pid,
+                _ => return SyscallOutcome::Complete(SyscallResult::Error(
+                    domain::error::KernelError::PermissionDenied {
+                        slot: process_cap,
+                        needed: types::permission::Permission::Execute,
+                    },
+                )),
+            },
+            Err(e) => return SyscallOutcome::Complete(SyscallResult::Error(e)),
+        };
+
+        let priority = types::bounded::Priority::new(16)
+            .unwrap_or_else(|| unreachable!());
+        let time_slice = types::time::TimeSlice::new(100);
+        let context = SavedContext::with_entry_and_stack(entry, stack);
+
+        let tid = match self.threads.spawn_with_context(target_pid, priority, time_slice, None, context) {
+            Ok(t) => t,
+            Err(e) => return SyscallOutcome::Complete(SyscallResult::Error(e)),
+        };
+
+        if let Err(e) = self.processes.get_mut(target_pid).and_then(|p| p.add_thread(tid)) {
+            let _ = self.threads.destroy(tid);
+            return SyscallOutcome::Complete(SyscallResult::Error(e));
+        }
+
+        let core = self.platform.core_id();
+        self.scheduler.add(tid, priority, core);
+        SyscallOutcome::Complete(SyscallResult::Value(tid.raw() as usize))
+    }
+
     pub(crate) fn handle_kill(
         &mut self,
         caller_pid: types::id::ProcessId,