Expand bounded awk/expr/test toward Issue 7; refresh man, profile 1.0.18,

posix matrix/dashboard, and syscalls/process_table schema alignment (v8).

Booter: replication_operator_sketch/corestore hints, HRPC allowlist tests,
Protomux cap channel 65536-byte bound + export, Wasm posix_profile_peek,
swarm-disk and security_posture docs.

Coreutils/kernel: pkg-swarm-index pathCapabilityEnvelopeVerify on get;
pathcap-verify --trusted failure hint; rebuild bins and sync seeder.

Docs: KERNEL_CONTRACT, kernel-extensions, capabilities index, environment
appendix (warm-cache tuning, cap channel, Wasm env), handbook observability,
vault threat model (multisig), developer-guide ctx/HRPC/Wasm, DOCUMENTATION
release-checklist note, release-checklist optional tier1 drift.

Changelog maintenance in bare-os-booter and bare-os-protocol.

kernel/etc/bare-os/pkg-index.example.json

@@ -7,6 +7,20 @@
       "driveKeyHex": "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef",
       "manifestSha256Hex": "optional content hash of package root",
       "publisherPubkeyHex": "optional ed25519 pubkey that signed this row"
+    },
+    "[email protected]": {
+      "driveKeyHex": "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef",
+      "pathCapabilityEnvelope": {
+        "schema": 1,
+        "note": "Illustrative only; replace pubkeyHex/signatureHex for real issuance. When present, pkg-swarm-index get calls ctx.bareOsVerifyPathCapabilityEnvelope and prints pathCapabilityEnvelopeVerify.",
+        "pubkeyHex": "0000000000000000000000000000000000000000000000000000000000000000",
+        "signatureHex": "00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000",
+        "payload": {
+          "expMs": 1893456000000,
+          "ops": ["read"],
+          "prefix": "/tmp/"
+        }
+      }
     }
   }
 }

kernel/etc/bare-os/posix_utilities.json

@@ -1,7 +1,7 @@
 {
   "schema": 2,
   "profileId": "bare-os-posix-like",
-  "generatedAt": "2026-04-06T01:43:58.480Z",
+  "generatedAt": "2026-04-06T03:01:17.010Z",
   "note": "Sparse POSIX Issue 7 coverage hints for /bin utilities. Omitted command names are not yet profiled here.",
   "commandIndex": [
     {

kernel/etc/bare-os/syscalls.example.json

@@ -3,7 +3,7 @@
   "ctxApiVersion": "1.53.0",
   "posixProfile": {
     "id": "bare-os-posix-like",
-    "version": "1.0.17"
+    "version": "1.0.18"
   },
   "ops": ["readFile", "writeFile", "socket"],
   "opsDetail": [
@@ -60,7 +60,7 @@
   "fdModel": {
     "schema": 1,
     "stdio": [0, 1, 2],
-    "processTableSchema": 7
+    "processTableSchema": 8
   },
   "signalModel": {
     "schema": 1,