feat(booter): OpenMetrics proc export, protomux wire JSON, audit batch API, and doc sync

Expose /proc/bare_os/metrics.prom (kernel counter OpenMetrics) and
/proc/bare_os/protomux.json (alias registry snapshot). Extend VFS routing,
readdir, pseudo watch, and bare_os_proc_index to schema 8; restore flat
/proc entries for syscalls and process_table with sort order matching
tests. Add ctx.bareOsAuditLogAppendBatch and bump BARE_OS_CTX_API_VERSION
to 1.30.0 with d.ts and compatibility-matrix updates.
Harden swarm peer ban backoff with jitter on the exponential window.
Refresh conformance matrix, environment appendix, booter package doc, and
handbook chapters for proc paths, param expansion V3, vault at rest, and
baretop snapshot keys. Align baretop-snapshot with bareOsReadBareTopSnapshot.

kernel/bin/iconv

@@ -97,9 +97,60 @@ function normEnc(s) {
     .toLowerCase()
     .replace(/[-_]/g, '')
   if (t === 'utf8' || t === 'utf8bom') return 'utf-8'
+  if (t === 'latin1' || t === 'iso88591' || t === 'cp819') return 'iso-8859-1'
+  if (t === 'utf16le' || t === 'utf16') return 'utf-16le'
+  if (t === 'utf16be') return 'utf-16be'
   return t
 }
 
+/**
+ * @param {Uint8Array} u8
+ * @param {string} enc TextDecoder label
+ * @returns {string}
+ */
+function decodeToString(u8, enc) {
+  const dec = new TextDecoder(enc, { fatal: true })
+  return dec.decode(u8)
+}
+
+/**
+ * @param {string} s
+ * @param {string} enc TextEncoder only does utf-8; special-case UTF-16
+ * @param {typeof import('b4a')} b4a
+ */
+function encodeFromString(s, enc, b4a) {
+  if (enc === 'utf-8' || enc === 'utf8') {
+    return b4a.from(s, 'utf8')
+  }
+  if (enc === 'utf-16le') {
+    const out = new Uint8Array(s.length * 2)
+    for (let i = 0; i < s.length; i++) {
+      const c = s.charCodeAt(i)
+      out[i * 2] = c & 0xff
+      out[i * 2 + 1] = (c >> 8) & 0xff
+    }
+    return out
+  }
+  if (enc === 'utf-16be') {
+    const out = new Uint8Array(s.length * 2)
+    for (let i = 0; i < s.length; i++) {
+      const c = s.charCodeAt(i)
+      out[i * 2] = (c >> 8) & 0xff
+      out[i * 2 + 1] = c & 0xff
+    }
+    return out
+  }
+  if (enc === 'iso-8859-1') {
+    const out = new Uint8Array(s.length)
+    for (let i = 0; i < s.length; i++) {
+      const c = s.charCodeAt(i)
+      out[i] = c > 255 ? 0x3f : c & 0xff
+    }
+    return out
+  }
+  throw new Error('iconv: unsupported output encoding')
+}
+
 async function run(ctx, argv) {
   let fromEnc = 'utf-8'
   let toEnc = 'utf-8'
@@ -136,9 +187,15 @@ async function run(ctx, argv) {
     break
   }
 
-  if (fromEnc !== 'utf-8' || toEnc !== 'utf-8') {
+  const supported = new Set([
+    'utf-8',
+    'iso-8859-1',
+    'utf-16le',
+    'utf-16be'
+  ])
+  if (!supported.has(fromEnc) || !supported.has(toEnc)) {
     ctx.console.error(
-      'iconv: only UTF-8 to UTF-8 is supported in this build (see getconf BARE_OS_ICONV_ENCODINGS)'
+      'iconv: unsupported encoding pair (supported: utf-8, iso-8859-1, utf-16le, utf-16be)'
     )
     ctx.exitCode = 1
     return
@@ -157,7 +214,30 @@ async function run(ctx, argv) {
     u8 = ctx.b4a.from(bareStdin(ctx), 'utf8')
   }
 
+  let mid = ''
+  try {
+    mid = decodeToString(u8, fromEnc)
+  } catch (e) {
+    ctx.console.error('iconv: invalid input for ' + fromEnc + ': ' + (e?.message || e))
+    ctx.exitCode = 1
+    return
+  }
+
+  let outU8
+  try {
+    outU8 = encodeFromString(mid, toEnc, ctx.b4a)
+  } catch (e) {
+    ctx.console.error('iconv: ' + (e?.message || e))
+    ctx.exitCode = 1
+    return
+  }
+
   const w = globalThis.process?.stdout?.write
-  if (typeof w === 'function') w.call(globalThis.process.stdout, u8)
-  else ctx.console.log(ctx.b4a.toString(u8, 'utf8'))
+  if (typeof w === 'function') w.call(globalThis.process.stdout, outU8)
+  else if (toEnc === 'utf-8' || toEnc === 'utf8') {
+    ctx.console.log(ctx.b4a.toString(outU8, 'utf8'))
+  } else {
+    ctx.console.error('iconv: binary output requires a TTY with binary stdout')
+    ctx.exitCode = 1
+  }
 }