fix: cmdline parser, VBE framebuffer, VA collision, ring3 test, code audit

fix: cmdline parser, VBE framebuffer, VA collision, ring3 test, code audit

- fix(cmdline): don't skip token 0 when GRUB2+Multiboot2 omits kernel path
  GRUB2 may pass only arguments (e.g. 'ring3') without the kernel path.
  The parser now only skips token 0 if it starts with '/'.

- feat(vbe): add Multiboot2 framebuffer request tag to boot.S
  Requests 1024x768x32 linear framebuffer from GRUB (optional flag=1).
  Add fb_type field to boot_info for detecting framebuffer vs text mode.
  VGA text console conditionally disabled when linear framebuffer active.

- fix(va): hal_mm_map_physical_range used 0xE0000000 (KVA_FRAMEBUFFER)
  This caused the initrd mapping to be destroyed when VBE mapped the
  framebuffer at the same VA. Moved to KVA_PHYS_MAP at 0xDC000000.

- fix(ring3): run ring3 test in own kernel thread instead of PID 0
  x86_usermode_test_start() enters ring3 via iret and never returns.
  Previously hidden because ring3 flag was never recognized (cmdline bug).

- feat(console): wire console= cmdline parameter to console subsystem
  Supports console=serial, console=vga, console=ttyS0, console=tty0.

- refactor: use KVA_FRAMEBUFFER from kernel_va_map.h in vbe.c
- cleanup: replace inline extern rtc_unix_timestamp with #include rtc.h
- fix(multiboot2): remove break after MODULE tag to scan ALL tags

Build: clean. cppcheck: clean. Tests: 20/20 smoke, 47/47 host unit.