Implement OP_ENVIRONMENT_TIME syscall

Summary

Implement an OP_ENVIRONMENT_TIME syscall to return the current time to userspace. Needed for timing-sensitive applications, benchmarking, and the service manager (restart backoff timers).

Current state

• No mechanism for userspace to query the current time
• The kernel has APIC timer infrastructure (DeadlineTracker) but no wall-clock or monotonic time exposed to userspace

Desired behaviour

Add OP_ENVIRONMENT_TIME syscall that returns:

• Monotonic time: Nanoseconds since boot (for measuring durations, timeouts)
• Wall-clock time (optional/future): Real time from RTC if available

Possible time sources

• TSC (Time Stamp Counter): High-resolution, low-overhead. Requires calibration against a known time source at boot. Most x86_64 CPUs have invariant TSC.
• ACPI PM Timer: 3.579545 MHz fixed-frequency timer. Reliable but lower resolution. Accessed via I/O port.
• RTC (Real-Time Clock): Wall-clock time from CMOS. Low resolution (1 second), but gives actual date/time.
• HPET: High-precision event timer. Good resolution but MMIO-based access is slower than TSC.

Suggested approach

1. Calibrate TSC frequency at boot using ACPI PM timer or PIT as reference
2. Store TSC offset at boot time
3. OP_ENVIRONMENT_TIME reads TSC, subtracts boot offset, converts to nanoseconds
4. Return as a 64-bit nanosecond value in the syscall response

Key files

• panda-abi/src/lib.rs — add OP_ENVIRONMENT_TIME opcode
• panda-kernel/src/syscall/ — implement the syscall handler
• panda-kernel/src/ — TSC calibration at boot (new module or extend existing timer code)
• libpanda/src/sys/mod.rs — add low-level wrapper
• libpanda/src/ — add high-level time::monotonic() function

Testing

• Kernel test: call OP_ENVIRONMENT_TIME twice with a busy-wait in between, verify the second value is larger
• Userspace test: measure time before and after a known operation, verify the delta is reasonable
• Test that the value is monotonically increasing across multiple calls

Documentation

• Document the syscall in panda-abi with doc comments
• Document the time source and resolution in libpanda doc comments
• Note any caveats (e.g., TSC may not be calibrated under QEMU TCG emulation)

Start with panda-abi/src/lib.rs and the syscall handlers under panda-kernel/src/syscall/, then trace the existing timer code under panda-kernel/src/. Review how time can be calibrated and exposed through libpanda/src/sys/mod.rs and libpanda/src/. Done means the opcode, kernel implementation, wrappers, documentation, and monotonicity tests work across the named kernel and userspace paths.