feat(kernel): console cap gates DebugPutchar, no uart fast path; spawn start arg in a0; delegate returns slot

docs/ipc.md

@@ -63,7 +63,17 @@ No process is privileged by its id. At boot the kernel gives init:
 - for every device in the board table, a capability to its MMIO region
   (`Read`, `Write`, `Delegate`; never `Execute`) and, if it interrupts, one
   to its IRQ line (`Execute`, `Delegate`);
-- one `SystemControl` capability (`Execute`, `Delegate`).
+- one `SystemControl` capability (`Execute`, `Delegate`);
+- one `Console` capability (`Write`, `Delegate`).
+
+`DebugPutchar(console, byte)` needs a `Console` capability with `Write`;
+there is no other way to reach the UART. Init lends its console to the
+servers it starts (snake gets none). Until the log server owns the console,
+boot code also grants one to the servers it loads itself.
+
+A thread made by `SpawnThread`/`SpawnThreadIn` starts with the caller's
+`arg` in `a0`. A process's first thread reads it as `types::start_arg`:
+the slots of the console and log capabilities it was handed.
 
 The board capabilities come after the capabilities boot code hands out
 for the built-in servers, so those slots are unchanged. Device regions
@@ -75,7 +85,8 @@ program a device's DMA; pool regions are physically contiguous.
 
 Boot also maps one read-only page into init at `types::bootinfo::BOOT_INFO_VA`
 listing, for each board device, its kind, physical base, IRQ line and the
-slots holding its region and IRQ capabilities, plus the SystemControl slot.
+slots holding its region and IRQ capabilities, plus the SystemControl and
+Console slots.
 It is the only page boot writes for userspace.
 
 ## Devices