feat: ctx 1.37.0, /bin/link, blind-peer proc gate, and CI/docs follow-ups

- Bump bareOsCtxApiVersion to 1.37.0; sync syscalls.example.json and ctx helper
- Add ctx.bareOsReadSnapshotHintsJson mirroring snapshot_hints proc JSON
- Gate blind_relay_router / blind_pairing_sketch / relay_geo_hint behind
  BARE_OS_PROC_BLIND_PEER_RELAY_HINTS; passthrough + env appendix docs
- Add POSIX link(1) via coreutils (link.js, man, commands list, kernel bin)
- Fix JSDoc in verify-runtime-no-incomplete-markers (avoid */ in glob text)
- Align posix-conformance-matrix bareOsSyscallOps with getconf (select, umask)
- Add verify-holepunch-clone-drift.mjs (opt-in pretest), holepunch-drift-repos.json,
  originMainHead in sync-holepunch-clones report
- Tests: warm /bin cache clear, blind proc stub, protomux pool schema 2, glob cap
- Docs: systemctl man, compatibility matrix boot.policy pins, handbook ch.5
  vault/proc note, package-bare-os-booter, kernel-extensions, developer-guide ctx
- CHANGELOG and bare-os-ctx.d.ts updates for subprocess bridge and mirror mounts

kernel/lib/bare/shell-completion.json

@@ -1,6 +1,6 @@
 {
   "schema": 1,
-  "atMs": 1775358188597,
+  "atMs": 1775359127851,
   "commands": [
     "arch",
     "awk",
@@ -65,6 +65,7 @@
     "kernel-preflight",
     "kernel-triage",
     "kill",
+    "link",
     "ln",
     "logger",
     "login",