feat(init): spawn service over IPC with per-client allowance refunded on child death; up to 4 death watchers; spawntest on test image

crates/domain/src/syscall.rs

@@ -93,7 +93,7 @@ pub enum Syscall {
         region: CapSlot,
     },
     /// Signals `notification` when the process behind `process` dies, by
-    /// exit, fault or kill. One watcher per process; a new one replaces it.
+    /// exit, fault or kill. Up to `timer::MAX_WATCHERS` per process.
     WatchDeath {
         process: CapSlot,
         notification: CapSlot,

crates/domain/src/timer.rs

@@ -18,6 +18,9 @@ pub struct Target {
     pub badge: Badge,
 }
 
+/// How many may watch one process die: its parent and init, with room.
+pub const MAX_WATCHERS: usize = 4;
+
 pub struct Timers {
     deadlines: [Option<(Ticks, Target)>; MAX_PROCESSES],
 }