feat(kernel): seL4-style IPC, notifications, status ABI

- badges + Mint, Call/Reply/ReplyRecv w/ gen-checked reply slot
- cap transfer (1/msg, copy, needs Delegate, rechecked at delivery)
- notifications: signal/wait/poll/bind, irq -> notification routing
- WaitAny/WaitForInterrupt removed; a0=status, ErrorCode
- libkos: single ecall primitive, compat wrappers + typed new api
- fix: trap return clobbered user t0 on every trap
- fix: wait queues FIFO, delegate keeps badge, fault cap checked
- docs/ipc.md spec, ipc tests, ipc fuzz, kani ntfn + waitqueue

crates/libkos/src/fs.rs

@@ -1,19 +1,24 @@
-use types::bounded::CapSlot;
 use crate::syscall;
+use types::bounded::CapSlot;
 
 #[derive(Debug, Clone, Copy, PartialEq, Eq)]
 pub struct FileHandle(u16);
 
 impl FileHandle {
-    pub const fn raw(&self) -> u16 { self.0 }
+    pub const fn raw(&self) -> u16 {
+        self.0
+    }
 }
 
 fn pack_path(path: &[u8]) -> (usize, usize) {
     let mut w0 = [0u8; 8];
     let mut w1 = [0u8; 8];
     for (i, &b) in path.iter().enumerate() {
-        if i < 8 { w0[i] = b; }
-        else if i < 16 { w1[i - 8] = b; }
+        if i < 8 {
+            w0[i] = b;
+        } else if i < 16 {
+            w1[i - 8] = b;
+        }
     }
     (usize::from_le_bytes(w0), usize::from_le_bytes(w1))
 }
@@ -26,7 +31,11 @@ fn ipc(ep: CapSlot, w0: usize, w1: usize, w2: usize, w3: usize) -> (usize, usize
 pub fn open(ep: CapSlot, path: &[u8]) -> Option<FileHandle> {
     let (p0, p1) = pack_path(path);
     let (tag, handle, _, _) = ipc(ep, 0, p0, p1, 0);
-    if tag == 0 { Some(FileHandle(handle as u16)) } else { None }
+    if tag == 0 {
+        Some(FileHandle(handle as u16))
+    } else {
+        None
+    }
 }
 
 pub fn read(ep: CapSlot, handle: FileHandle, max_bytes: usize) -> Option<usize> {
@@ -52,7 +61,11 @@ pub fn list_dir(ep: CapSlot, path: &[u8]) -> Option<usize> {
 pub fn create(ep: CapSlot, path: &[u8]) -> Option<FileHandle> {
     let (p0, p1) = pack_path(path);
     let (tag, handle, _, _) = ipc(ep, 5, p0, p1, 0);
-    if tag == 0 { Some(FileHandle(handle as u16)) } else { None }
+    if tag == 0 {
+        Some(FileHandle(handle as u16))
+    } else {
+        None
+    }
 }
 
 pub fn delete(ep: CapSlot, path: &[u8]) -> bool {