Expand bounded awk/expr/test toward Issue 7; refresh man, profile 1.0.18,

posix matrix/dashboard, and syscalls/process_table schema alignment (v8).

Booter: replication_operator_sketch/corestore hints, HRPC allowlist tests,
Protomux cap channel 65536-byte bound + export, Wasm posix_profile_peek,
swarm-disk and security_posture docs.

Coreutils/kernel: pkg-swarm-index pathCapabilityEnvelopeVerify on get;
pathcap-verify --trusted failure hint; rebuild bins and sync seeder.

Docs: KERNEL_CONTRACT, kernel-extensions, capabilities index, environment
appendix (warm-cache tuning, cap channel, Wasm env), handbook observability,
vault threat model (multisig), developer-guide ctx/HRPC/Wasm, DOCUMENTATION
release-checklist note, release-checklist optional tier1 drift.

Changelog maintenance in bare-os-booter and bare-os-protocol.

kernel/etc/bare-os/pkg-index.example.json

@@ -7,6 +7,20 @@
       "driveKeyHex": "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef",
       "manifestSha256Hex": "optional content hash of package root",
       "publisherPubkeyHex": "optional ed25519 pubkey that signed this row"
+    },
+    "[email protected]": {
+      "driveKeyHex": "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef",
+      "pathCapabilityEnvelope": {
+        "schema": 1,
+        "note": "Illustrative only; replace pubkeyHex/signatureHex for real issuance. When present, pkg-swarm-index get calls ctx.bareOsVerifyPathCapabilityEnvelope and prints pathCapabilityEnvelopeVerify.",
+        "pubkeyHex": "0000000000000000000000000000000000000000000000000000000000000000",
+        "signatureHex": "00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000",
+        "payload": {
+          "expMs": 1893456000000,
+          "ops": ["read"],
+          "prefix": "/tmp/"
+        }
+      }
     }
   }
 }