feat(exec): Run userland in ring 3 with an ELF64 loader and per-process page tables

SUB-OS had a syscall table and user GDT descriptors but nothing that could
actually leave ring 0: lazybox and the shell run as kernel code, and
syscall_handler() was never reachable from a user program. This adds the
missing path end to end on x86_64.

Address spaces (arch/x86_64/mm/vmspace.c)
- The boot page tables identity-map the low 4 GB off PML4[0] and leave the
  rest empty, so userland is given its own PML4 slot (512 GiB) rather than
  holes punched in the kernel's 2 MB huge-page map. A process PML4 shares
  entry 0 with the kernel and privately owns entry 1.
- Frames outside the identity map are refused rather than written through an
  unmapped pointer; lifting that needs a recursive map or a higher-half
  direct map, which is noted in the file.

ELF loader (kernel/elf.c)
- Validates ELF64/little-endian/ET_EXEC/machine, bounds-checks every program
  header against both the image and the user address range, and lays PT_LOAD
  segments into an address space. Frames arrive zeroed, so .bss is covered.

Ring transition (arch/x86_64/cpu/usermode.asm)
- user_enter() drops to ring 3 via iretq after scrubbing every GPR, and
  user_return() unwinds back to it when the process exits, so exec looks like
  a call that blocks until the program finishes.

Syscalls
- INT 0x80 installed at DPL 3 with the Linux x86_64 register convention.
  The process gets its own kernel stack for the trap, because TSS.rsp0 must
  not point at the stack user_enter() is standing on.
- Every user pointer is range-checked before use. The process page tables are
  still live during a syscall, so without that check a program could pass a
  kernel address and have write(2) dump kernel text to the console. The new
  /sbin/init asserts both a wild pointer and a kernel pointer are rejected.
- write(2) to stdout/stderr routes through the new console_write(), which
  reuses printk's routing so output reaches serial and the framebuffer
  console rather than only the VGA text buffer.

Faults
- A ring 3 exception now kills that process and reports CR2 instead of
  panicking the machine.

Userland (userland/init/)
- /sbin/init is a real freestanding static executable, linked at the user
  base and embedded in the kernel image by scripts/mkblob.py. It reports its
  pid, verifies .bss was zeroed and .data is writable, checks the two pointer
  rejections, and exits.

aarch64 and armv8i keep building: the loader and exec path are portable, and
those ports get honest vmspace stubs that fail cleanly rather than pretending
to run a program with kernel privileges.

Verified under QEMU: init loads at 0x80004000a0, reports pid 1, .bss zeroed,
.data writable, both bad pointers rejected, and exits 0 back into the shell.

Co-Authored-By: Claude Opus 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_0161Jh7uCEMLYEMNPsjC1LKf

arch/aarch64/mm/vmspace.c

@@ -0,0 +1,42 @@
+#include <mm/vmspace.h>
+
+/*
+ * Userland address spaces are not wired up on this architecture yet.
+ *
+ * The ELF loader and exec path are portable, but they need per-process page
+ * tables and a ring-3 entry path that only the x86_64 port implements today.
+ * These stubs fail cleanly so a userland exec reports "not supported" instead
+ * of silently running a program with kernel privileges.
+ */
+
+vmspace_t* vmspace_create(void) { return NULL; }
+void vmspace_destroy(vmspace_t* vm) { (void)vm; }
+
+int vmspace_map_page(vmspace_t* vm, uint64_t virt, uint64_t phys, int prot) {
+    (void)vm; (void)virt; (void)phys; (void)prot;
+    return -1;
+}
+
+int vmspace_alloc(vmspace_t* vm, uint64_t virt, size_t len, int prot) {
+    (void)vm; (void)virt; (void)len; (void)prot;
+    return -1;
+}
+
+int vmspace_write(vmspace_t* vm, uint64_t dst, const void* src, size_t len) {
+    (void)vm; (void)dst; (void)src; (void)len;
+    return -1;
+}
+
+uint64_t vmspace_resolve(vmspace_t* vm, uint64_t virt) {
+    (void)vm; (void)virt;
+    return 0;
+}
+
+void vmspace_switch(vmspace_t* vm) { (void)vm; }
+
+bool vmspace_range_ok(vmspace_t* vm, uint64_t virt, size_t len) {
+    (void)vm; (void)virt; (void)len;
+    return false;
+}
+
+uint64_t vmspace_resident_pages(vmspace_t* vm) { (void)vm; return 0; }