refactor(adapter-riscv): split kmain into boot/, devices/ modules

kmain is now 20 lines — six function calls:

  hardware::init        → BSS, MMU, traps, timer, PLIC, kernel
  loader::load_init     → read init.elf, create process, map ELF
  loader::load_server   → read server ELF, create process, map ELF
  storage_setup         → VirtIO block re-init, shared buffer, phys-info
  gpu_setup             → VirtIO GPU init, framebuffer alloc, phys-info
  caps::grant_all       → endpoints, capability grants

New modules:
  boot/hardware.rs   — hardware init (BSS, MMU, traps, kernel)
  boot/loader.rs     — ELF loading, thread setup, enter_userspace
  boot/caps.rs       — endpoint creation, capability grants
  devices/storage_setup.rs — VirtIO block for storage server
  devices/gpu_setup.rs     — VirtIO GPU for display server

All unsafe contained in hw/, mmu/, trap/. Boot and device
modules call safe wrappers.

crates/adapter-riscv/src/boot/caps.rs

@@ -0,0 +1,50 @@
+use crate::hw::uart::Uart;
+use crate::kernel_ref;
+use types::id::ProcessId;
+
+pub fn grant_all(
+    uart: &Uart,
+    init_pid: ProcessId,
+    storage_pid: ProcessId,
+    display_pid: ProcessId,
+) {
+    let all_perms = types::permission::PermissionSet::empty()
+        .with(types::permission::Permission::Read)
+        .with(types::permission::Permission::Write)
+        .with(types::permission::Permission::Execute)
+        .with(types::permission::Permission::Delegate);
+
+    let ipc_perms = types::permission::PermissionSet::empty()
+        .with(types::permission::Permission::Read)
+        .with(types::permission::Permission::Execute);
+
+    // Storage endpoint
+    let storage_ep = kernel_ref().create_endpoint()
+        .unwrap_or_else(|_| crate::halt(uart, "storage endpoint failed"));
+
+    // Init: slot 0 = ProcessCreate (from boot), slot 1 = Process(storage), slot 2 = Endpoint(storage)
+    kernel_ref().grant_capability(init_pid, domain::resource::Resource::Process(storage_pid), all_perms)
+        .unwrap_or_else(|_| crate::halt(uart, "grant failed"));
+    kernel_ref().grant_capability(init_pid, domain::resource::Resource::Endpoint(storage_ep), all_perms)
+        .unwrap_or_else(|_| crate::halt(uart, "grant failed"));
+
+    // Storage: slot 0 = Endpoint
+    kernel_ref().grant_capability(storage_pid, domain::resource::Resource::Endpoint(storage_ep), ipc_perms)
+        .unwrap_or_else(|_| crate::halt(uart, "grant failed"));
+
+    // Display endpoint
+    let display_ep = kernel_ref().create_endpoint()
+        .unwrap_or_else(|_| crate::halt(uart, "display endpoint failed"));
+
+    // Display: slot 0 = Endpoint
+    kernel_ref().grant_capability(display_pid, domain::resource::Resource::Endpoint(display_ep), ipc_perms)
+        .unwrap_or_else(|_| crate::halt(uart, "grant failed"));
+
+    // Init: slot 3 = Endpoint(display), slot 4 = Process(display)
+    kernel_ref().grant_capability(init_pid, domain::resource::Resource::Endpoint(display_ep), all_perms)
+        .unwrap_or_else(|_| crate::halt(uart, "grant failed"));
+    kernel_ref().grant_capability(init_pid, domain::resource::Resource::Process(display_pid), all_perms)
+        .unwrap_or_else(|_| crate::halt(uart, "grant failed"));
+
+    uart.write_str("k-os: capabilities granted\n");
+}