feat(kernel): lazy user FPU: off until first FP insn (illegal-insn trap -> zeroed regs, retry), save on dirty trap, restore on switch, off for threads without + kernel; spawntest per-thread FP check

docs/ipc.md

@@ -320,6 +320,15 @@ set it stays masked.
 - A saved reply is named only within the thread that saved it: it cannot
   be passed on, and another thread's number means nothing.
 
+## Floating point
+
+A thread starts without floating-point registers, and the FPU off. Its
+first floating-point instruction traps; the kernel gives it registers, all
+zero, turns the FPU on and runs the instruction again. From then on its
+registers are saved when a trap finds them changed and loaded whenever it
+runs; a thread without them runs with the FPU off, so it can never read
+another's. The kernel itself never uses the FPU.
+
 ## Budgets
 
 Every process has a budget: frames (its pages, page tables and regions'