feat(kernel): Wave 9 mega-phase — bits9, protocol 0.5, boot policy v9, Pear/Bare bridge

- Add ninth capability word (bits9), STOCK_V9, FEATURE9_*; bump feature bits doc to 11
- Extend seed RPCs, channel wiring, replication/staging adjuncts; bare_os_proc_index schema 5
- Wave 9 /proc JSON via bare-os-wave9-proc.js + VFS aliases; ctx API 1.18.0 + d.ts hooks
- Boot policy v9 + kernel/init.js enforcement; extensions registry schema 6; strict bits9 caps
- NDJSON lifecycle 8, OTel 6, audit 6; SOCKS proxy map, worker/WASM/env passthrough
- Coreutils openssl stub (bare-crypto doc); mediaproc:* worker group; http-fetch SOCKS lookup
- CI: verify-kernel-roadmap-wave9.mjs, wave3/ctx/dts/compat updates; pretest chain
- Docs: roadmap Wave 9 table, ADR §12, kernel-extensions/capabilities/matrix/protocol/handbook/
  developer-guide (node-to-bare-modules, privacy), kernel README, scripts README, changelogs
- Sync packages/bare-os-seeder/kernel (init.js, README); refresh booter /proc readdir test list

packages/bare-os-coreutils/lib/commands.mjs

@@ -68,6 +68,7 @@ export const COREUTILS_COMMANDS = [
   'nproc',
   'numfmt',
   'od',
+  'openssl',
   'oidc-publish',
   'paste',
   'pathchk',

packages/bare-os-coreutils/man/pages/openssl.json

@@ -0,0 +1,15 @@
+{
+  "name": "openssl",
+  "section": 1,
+  "title": "openssl",
+  "synopsis": [
+    "openssl [OPTION]... [OPERAND]..."
+  ],
+  "description": "Bare OS implementation of openssl. Full behavior is defined in packages/bare-os-coreutils/src/openssl.js.",
+  "options": [],
+  "keywords": [
+    "openssl",
+    "bare-os",
+    "coreutils"
+  ]
+}

packages/bare-os-coreutils/src/openssl.js

@@ -0,0 +1,24 @@
+/**
+ * Minimal placeholder: OpenSSL CLI is not bundled. Documents use of bare-crypto on Pear/Bare
+ * hosts instead of Node `node:crypto` (unavailable in guest bare runtime).
+ */
+async function run(ctx, argv) {
+  for (let i = 1; i < argv.length; i++) {
+    if (argv[i] === '-h' || argv[i] === '--help') {
+      ctx.console.log(
+        'usage: openssl [help]\n' +
+          'Bare OS stub: no OpenSSL binary. Use the host `bare-crypto` module from Pear apps;\n' +
+          'do not rely on Node built-ins such as node:crypto in kernel or /bin utilities.'
+      )
+      return
+    }
+    if (argv[i].startsWith('-')) {
+      ctx.console.error('openssl: unsupported option ' + argv[i])
+      ctx.exitCode = 1
+      return
+    }
+  }
+  ctx.console.log(
+    'openssl: stub — use bare-crypto (see handbook ch.9 and developer-guide Node→Bare map).'
+  )
+}