feat(booter): hrpc allowlist parser, snapshot hints parity, shell pipefix, safer mv staging

- Add bare-os-hrpc-allowlist.js; wire stock bareOsHrpcRequest + bareOsHrpcAllowlistProbe;
  passthrough BARE_OS_HRPC_ALLOWLIST_JSON and operator env for snapshot/blind-relay/mirror/pear-doctor
- Merge BARE_OS_CORESTORE_SNAPSHOT_WORKFLOW_JSON into bareOsReadSnapshotHintsJson (match proc)
- Shell: pipefail runs all pipeline stages; aggregate first non-zero exit after assign prefixes
- mv: stage renames via vfs.resolveLogical so temp files stay in writable destination dir
- coreutils: POSIX-style split suffixes past zz; xargs doc for -P vs host subprocess
- identity-session: stable Error.code for no-account / passphrase failures
- Docs: KERNEL_CONTRACT, POSIX profile, handbook 5/7/9, kernel-extensions strict-boot table,
  env appendix, developer-guide + scripts README, protocol/booter CHANGELOGs; hrpc allowlist schema
- Tests: hrpc allowlist, pear_doctor schema 2, split suffix, pipefail pipeline; fix PLACEHOLDER_BASELINE link

Pretest: refreshed kernel bins, man.json, posix dashboard, bundle health, seeder parity

developer-guide/12-bare-modules-and-pear-ecosystem.md

@@ -10,6 +10,8 @@ This chapter ties together **Holepunch `bare-*` packages**, the **Pear** host ru
 
 2. **`ctx.bare` (host fallback)** — Unless **`BARE_OS_BARE_HOST_IMPORTS=0`**, the booter then **`import()`**s any manifest packages **still missing** after drive merge—typically native or Bare-only packages that could not be bundled, or when the image is older than the manifest. Set **`BARE_OS_BARE_HOST_IMPORTS=0`** for a **fully image-local** `ctx.bare` (no Pear host `node_modules` participation). Disable all `ctx.bare` with **`BARE_OS_BARE_MODULES=0`**. Manifest rows may include optional **`tier`** (**`core`** vs extended) and **`risk`** (**`low`**, **`medium`**, **`high`**) for distributor policy; the build honors **`tier`** via **`BARE_OS_BUNDLE_TIER`**.
 
+**Boot cold path / stdlib budget:** the stock booter measures drive merge + host **`import()`** resolution for **`ctx.bare`** and sets **`BARE_OS_BOOT_BARE_STDLIB_RESOLUTION_MS`** before the guest starts. Operators may set **`BARE_OS_BOOT_BUDGET_MS_BARE_STDLIB`** to log **`boot-perf.json`** / stderr warnings when resolution exceeds the budget; combine with **`BARE_OS_BUNDLE_TIER=core`** (or a smaller manifest) to shrink cold I/O. Use **`node scripts/kernel-microbench.mjs`** for regression-shaped timings (not a literal Pear cold boot).
+
 3. **The full mirror (discoverability)** — A local checkout of Holepunch repos (for example **`holepunchto_repos`** under your Pear tooling tree) lists on the order of **150+** repositories whose names start with **`bare-`**. Many are **native addons**, **platform-specific** (mobile, GUI, FFmpeg, …), or **developer tools**. The **manifest** can list them for `ctx.bare`, but only rows that bundle cleanly become real drive IIFEs; the rest rely on host import or stubs until you trim the manifest.
 
 ---

developer-guide/README.md

@@ -18,7 +18,7 @@ This project is **experimental research software**. APIs described here follow t
 
 **Kernel source set:** [`docs/reference/kernel-extensions.md`](../docs/reference/kernel-extensions.md) — first-party paths (`kernel/init.js`, `kernel/lib/boot`, built `/bin`) vs vendored **`kernel/lib/bare/bundles`** (Holepunch IIFEs), CI allowlists, and seeder parity. Hand-authored code must stay free of incomplete markers; bundles are gated by **`verify-bundle-markers.mjs`**, **`verify-bundle-throws.mjs`** ( **`new Error` messages** with *not implemented* / abstract-base-class semantics — see [`docs/audit/bundle-throw-allowlist.json`](../docs/audit/bundle-throw-allowlist.json)), and **`sanitize-bare-bundles.mjs`**. Prefer shrinking the throw allowlist via upstream bundle refreshes over silent drift.
 
-**Local Holepunch clones:** run **`node scripts/sync-holepunch-clones.mjs`** to emit **`docs/audit/holepunch-clone-sync-report.json`** comparing **`bare-module-manifest.json`** names to optional checkouts under **`BARE_OS_HOLEPUNCH_CLONES_ROOT`** (default **`~/dev/pearcli/holepunch-repos/holepunchto_repos`**).
+**Local Holepunch mirror:** run **`node scripts/sync-holepunch-clones.mjs`** to emit **`docs/audit/holepunch-clone-sync-report.json`** comparing manifest package names to optional checkouts under **`BARE_OS_HOLEPUNCH_CLONES_ROOT`** (default **`~/dev/pearcli/holepunch-repos/holepunchto_repos`**). Root **`pretest`** runs **`node scripts/verify-holepunch-clone-drift.mjs`** against basenames listed in **`docs/audit/holepunch-drift-repos.json`** (empty **`repos[]`** = no-op). Regenerate the maximal npm catalog with **`node scripts/gen-bare-holepunch-catalog.mjs`** (or **`npm run gen:bare-catalog`**), then **`npm run sync:bare-manifest`** — see [scripts/README.md](../scripts/README.md).
 
 ---