root: find the filesystem instead of being told at build time, and fix dmesg

`#define ROOTDEV 1` -- IDE disk 1 -- so a kernel could only ever root on the
disk it was *built* expecting. Booting the same image from a USB stick was
impossible by construction, and that was the one thing standing between this
kernel and its own acceptance test, which begins "boot on real hardware from a
USB stick".

rootdev_mount() probes. schfs_kmount() was already written for exactly this --
its own comment says "the uberblock scan doubles as the probe: no valid
uberblock means this is simply not a SchFS volume, which is not an error worth
reporting loudly" -- and a failed probe leaves the slot unmounted and reusable,
which is what makes a loop over candidates legal at all. So the change is one
function and one call site; the only real use of ROOTDEV was `schfs_kmount()`.

Order is preference, not confidence: a RAMDISK_ROOT build wins outright, then
USB, then IDE 1, then IDE 0. USB before the fixed disks because a stick that is
plugged in was plugged in on purpose. iderw() panics on an absent drive rather
than failing, so each candidate is checked with ide_disk_present() /
usb_storage_present() first -- which is what those predicates are for.

Verified with **no IDE disk attached at all**: boots, mounts the stick, writes
a file, and the file is still there on the next boot.

    [    0.000021] root: USB disk (device 3)

And when nothing matches, it names what it looked at, because "no root
filesystem" with no list is the least useful thing a kernel can say at the one
moment somebody needs to know which disk it expected:

    root: no SchFS volume on any candidate device. Looked at:
      device 3, USB disk: not present
      device 1, IDE disk 1: not present
      device 0, IDE disk 0: present, but no SchFS on it

**That message is also how dmesg turned out to be broken**, because it did not
appear in `dmesg` and should have. `dmesg` printed *nothing at all*, on a
system whose boot banner says "or dmesg once you are in" and whose entire
quiet-boot design is "route the detail into the kernel log and say how to read
it". The log was there the whole time -- `cat /proc/kmsg` has always worked --
but the one command anybody would reach for could not see it.

Two separate faults, each alone enough:

  - **sys_syslog() was `return 0`.** dmesg does not read /proc/kmsg; it calls
    klogctl(10) for the buffer size and klogctl(3) to read. 0 to the first one
    means "the log is zero bytes", and a stub that answers 0 is
    indistinguishable from a machine that logged nothing. Implemented for the
    actions that mean something here; the rest return -EINVAL rather than 0,
    because a console log level this kernel does not have is not a request that
    succeeded.

  - **With that fixed, dmesg was still empty.** It parses every line with
    `sscanf(msg, "<%u>[%llu.%llu] %n", ...)` and silently drops anything that
    does not match. The ring's `[     0.00] text` already matches everything
    after the priority -- scanf skips the leading spaces -- so the only missing
    thing was the `<6>`. klog_render_syslog() adds it on the way out rather
    than storing it: the ring is also what a person reads with `cat
    /proc/kmsg` and what PSOGM points at after a crash, and an ABI detail
    belongs at the boundary that has the ABI.

Also: the first version of the no-root diagnostic printed

    %-11s device 1596400

because cprintf() has no field-width specifier -- it prints "%-11s" literally
and then reads the next argument for the %d. Plain %s now, with the note.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

include/defs.h

@@ -396,6 +396,7 @@ int             klog_read(uint64 off, char *dst, int n);
 uint64          klog_len(void);
 uint64          klog_prev_bytes(void);
 int             klog_recovered(void);
+int             klog_render_syslog(char *dst, int cap);
 
 // ksym.c -- naming a kernel address. See docs/architecture/debugging.md, D0.
 int             ksym_ready(void);