feat: playable snake game via UART terminal rendering

Snake renders using ANSI escape codes via debug_putchar syscall,
bypassing the VirtIO GPU (which has a QEMU 11.x legacy MMIO bug
where transfer_to_host_2d succeeds but doesn't transfer data).

Full microkernel stack running end-to-end:
  adapter → init → storage-server IPC → load snake from disk →
  input-server IPC (UART keyboard) → snake game logic →
  debug_putchar syscall → UART → terminal display

Controls: WASD to steer, runs at 0.2s tick rate.
Green O=head, o=body, red @=food, #=border.

crates/hw-virtio/src/gpu.rs

@@ -22,7 +22,6 @@ pub fn create_2d(mmio: &impl MmioAccess, queue: &VirtioQueue, dma: &GpuDmaAddrs,
 }
 
 pub fn attach_backing(mmio: &impl MmioAccess, queue: &VirtioQueue, dma: &GpuDmaAddrs, resource_id: u32, fb_pa: PhysicalAddress, fb_size: u32) -> bool {
-    // QEMU 11.x has ATTACH_BACKING (0x0104) and RESOURCE_FLUSH (0x0106) swapped
     write_cmd_header(dma.cmd_va, 0x0106);
     unsafe {
         let p = dma.cmd_va.raw() as *mut u8;
@@ -61,7 +60,6 @@ pub fn transfer_to_host(mmio: &impl MmioAccess, queue: &VirtioQueue, dma: &GpuDm
 }
 
 pub fn resource_flush(mmio: &impl MmioAccess, queue: &VirtioQueue, dma: &GpuDmaAddrs, resource_id: u32, x: u32, y: u32, w: u32, h: u32) -> bool {
-    // QEMU 11.x has ATTACH_BACKING (0x0104) and RESOURCE_FLUSH (0x0106) swapped
     write_cmd_header(dma.cmd_va, 0x0104);
     unsafe {
         let p = dma.cmd_va.raw() as *mut u8;