feat(booter): OpenMetrics proc export, protomux wire JSON, audit batch API, and doc sync

Expose /proc/bare_os/metrics.prom (kernel counter OpenMetrics) and
/proc/bare_os/protomux.json (alias registry snapshot). Extend VFS routing,
readdir, pseudo watch, and bare_os_proc_index to schema 8; restore flat
/proc entries for syscalls and process_table with sort order matching
tests. Add ctx.bareOsAuditLogAppendBatch and bump BARE_OS_CTX_API_VERSION
to 1.30.0 with d.ts and compatibility-matrix updates.
Harden swarm peer ban backoff with jitter on the exponential window.
Refresh conformance matrix, environment appendix, booter package doc, and
handbook chapters for proc paths, param expansion V3, vault at rest, and
baretop snapshot keys. Align baretop-snapshot with bareOsReadBareTopSnapshot.

kernel/lib/bare/README.md

@@ -20,8 +20,8 @@ Self-contained **`ctx.bare` support** on the **system** Hyperdrive: Holepunch **
 ## What gets staged
 
 - **`bare-module-manifest.json`** — Copy of the booter manifest (same keys and packages as host resolution). Tells the runtime which logical module names exist.
-- **`manifest.json`** — Drive loader index: **`bundles`** lists IIFE paths that assign into **`globalThis.__bare_os_stdlib__`**; **`bundleStats`** summarizes esbuild success versus stub-only placeholders (per-entry success/failure counts and paths).
-- **`bundles/*.js`** — One file per manifest row. Successful builds are full IIFE bundles; failures are no-op stubs (see the file header comment). Regenerate with **`npm run build -w bare-os-bare-libs`**.
+- **`manifest.json`** — Drive loader index: **`bundles`** lists IIFE paths that assign into **`globalThis.__bare_os_stdlib__`**; **`bundleStats`** counts attempted bundles; **`bundleDiagnostics`** lists each bundle’s byte size (same data as **`docs/audit/bundle-health.json`**).
+- **`bundles/*.js`** — One esbuild IIFE per catalog entry. The bare-libs build is **fail-fast** (esbuild errors abort; no stub placeholders). Stale **`*.js`** left from older tiered builds are **pruned** on each successful build. Regenerate with **`npm run build -w bare-os-bare-libs`** (updates **`docs/audit/bundle-health.json`**).
 
 At boot the booter runs **drive bundles first**, then (unless **`BARE_OS_BARE_HOST_IMPORTS=0`**) fills any missing keys via host **`import()`** so development iterations can patch a single package without re-seeding the entire drive.
 
@@ -58,9 +58,11 @@ The authoritative list is in the [environment appendix](../../../docs/reference/
 
 ---
 
-## When builds fail (stubs)
+## When builds fail
 
-If **`bundleStats`** shows failures, open the corresponding **`bundles/*.js`** stub: the header usually names the missing dependency or unsupported pattern. Fix the catalog entry, adjust esbuild options in **`packages/bare-os-bare-libs/build.mjs`**, or mark the module optional in the manifest until the ecosystem catches up. **`npm run smoke:bare-manifest`** guards required imports listed in the manifest smoke list.
+Esbuild prints the failing **`ctxKey`** and package. Fix **`bare-module-manifest.json`**, adjust **`build.mjs`** (plugins, platform), or mark the entry **`optional`** / **`bundle: false`** when host-only resolution is intended. **`npm run smoke:bare-manifest`** guards required imports listed in the manifest smoke list.
+
+**CI:** **`scripts/verify-bundle-health.mjs`** checks **`docs/audit/bundle-health.json`** against on-disk sizes; **`scripts/verify-bundle-markers.mjs`** flags **`TODO` / `NOT_IMPLEMENTED`** substrings in bundles unless listed in **`docs/audit/bundle-marker-allowlist.json`** (shrink over time).
 
 ---
 

kernel/lib/bare/bundles/bareAppImage.js

@@ -1,3 +0,0 @@
-/* bare-os-bare-libs: esbuild failed for bare-app-image — Build failed with 1 error:
-../../bare-lib-entry-bareAppImage.js:1:15: ERROR: Could not resolve "bare-app-image" */
-;(function(){})();

kernel/lib/bare/bundles/bareBuild.js

@@ -1,3 +0,0 @@
-/* bare-os-bare-libs: esbuild failed for bare-build — Build failed with 1 error:
-../../node_modules/bare-build/lib/platform/linux/create-app-image.js:5:37: ERROR: Could not resolve "bare-app-image" */
-;(function(){})();

kernel/lib/bare/bundles/bareCompatNapi.js

@@ -1,3 +0,0 @@
-/* bare-os-bare-libs: esbuild failed for bare-compat-napi — Build failed with 1 error:
-../../bare-lib-entry-bareCompatNapi.js:1:15: ERROR: Could not resolve "bare-compat-napi" */
-;(function(){})();

kernel/lib/bare/bundles/bareHeaders.js

@@ -1,3 +0,0 @@
-/* bare-os-bare-libs: esbuild failed for bare-headers — Build failed with 1 error:
-../../bare-lib-entry-bareHeaders.js:1:15: ERROR: Could not resolve "bare-headers" */
-;(function(){})();

kernel/lib/bare/shell-completion.json

@@ -1,6 +1,6 @@
 {
   "schema": 1,
-  "atMs": 1775344081319,
+  "atMs": 1775344958635,
   "commands": [
     "arch",
     "awk",