introduce a stable NTL_DDK driver ABI to replace direct HAL_API and kernel-header access in drivers, add code/kernel/io_ddk.c and code/public/ntlite/ddk/ headers, change DriverEntry to take (const NTL_DDK*, NTL_DRIVER_INIT*), update kmain to build the DDK once via IoInitializeDdk/IoGetDdk and hand it to both boot and runtime drivers, downgrade code/public/ntlite/ddi/io_driver.h to a legacy I/O model header pulling from ntlite/ddk instead of kernel internals, move code/third_party/lwip into code/drivers/net/lwip/third_party, fix up lwip_sources.txt and build.c include paths to match, split build.c's single CFLAGS macro into COMMON/KERNEL/USER/BOOT/DRIVER cflags.

code/public/ntlite/ddk/platform.h

@@ -0,0 +1,23 @@
+// Public nt-lite DDK platform declarations.
+
+#pragma once
+
+#include <stdint.h>
+
+// Driver-visible platform services. PCI bus policy stays in pci.sys; these are
+// only the raw platform hooks needed by the PCI bus driver itself.
+typedef struct NTL_DDK_PLATFORM {
+    uint32_t (*PciRead32)(uint16_t segment,
+                          uint8_t bus,
+                          uint8_t device,
+                          uint8_t function,
+                          uint16_t offset);
+    void     (*PciWrite32)(uint16_t segment,
+                           uint8_t bus,
+                           uint8_t device,
+                           uint8_t function,
+                           uint16_t offset,
+                           uint32_t value);
+    uint32_t (*GetBspLapicId)(void);
+    uint8_t  (*IsX2ApicEnabled)(void);
+} NTL_DDK_PLATFORM;