feat: ctx 1.37.0, /bin/link, blind-peer proc gate, and CI/docs follow-ups

- Bump bareOsCtxApiVersion to 1.37.0; sync syscalls.example.json and ctx helper
- Add ctx.bareOsReadSnapshotHintsJson mirroring snapshot_hints proc JSON
- Gate blind_relay_router / blind_pairing_sketch / relay_geo_hint behind
  BARE_OS_PROC_BLIND_PEER_RELAY_HINTS; passthrough + env appendix docs
- Add POSIX link(1) via coreutils (link.js, man, commands list, kernel bin)
- Fix JSDoc in verify-runtime-no-incomplete-markers (avoid */ in glob text)
- Align posix-conformance-matrix bareOsSyscallOps with getconf (select, umask)
- Add verify-holepunch-clone-drift.mjs (opt-in pretest), holepunch-drift-repos.json,
  originMainHead in sync-holepunch-clones report
- Tests: warm /bin cache clear, blind proc stub, protomux pool schema 2, glob cap
- Docs: systemctl man, compatibility matrix boot.policy pins, handbook ch.5
  vault/proc note, package-bare-os-booter, kernel-extensions, developer-guide ctx
- CHANGELOG and bare-os-ctx.d.ts updates for subprocess bridge and mirror mounts

kernel/etc/bare-os/syscalls.example.json

@@ -1,6 +1,6 @@
 {
   "schemaVersion": 4,
-  "ctxApiVersion": "1.36.0",
+  "ctxApiVersion": "1.37.0",
   "posixProfile": {
     "id": "bare-os-posix-like",
     "version": "1.0.3"
@@ -21,7 +21,7 @@
   "posixXsh": {
     "schema": 1,
     "note": "POSIX.1 XSH names in opsDetail with posixAlignment; not ctx.bareOsSyscall op strings.",
-    "namesCsv": "open,close,read,write,lseek,pipe,dup,dup2,fcntl,poll"
+    "namesCsv": "open,close,read,write,lseek,pipe,dup,dup2,fcntl,poll,select,umask"
   },
   "errnoHints": {
     "ENOENT": 2,