feat(booter): hrpc allowlist parser, snapshot hints parity, shell pipefix, safer mv staging

- Add bare-os-hrpc-allowlist.js; wire stock bareOsHrpcRequest + bareOsHrpcAllowlistProbe;
  passthrough BARE_OS_HRPC_ALLOWLIST_JSON and operator env for snapshot/blind-relay/mirror/pear-doctor
- Merge BARE_OS_CORESTORE_SNAPSHOT_WORKFLOW_JSON into bareOsReadSnapshotHintsJson (match proc)
- Shell: pipefail runs all pipeline stages; aggregate first non-zero exit after assign prefixes
- mv: stage renames via vfs.resolveLogical so temp files stay in writable destination dir
- coreutils: POSIX-style split suffixes past zz; xargs doc for -P vs host subprocess
- identity-session: stable Error.code for no-account / passphrase failures
- Docs: KERNEL_CONTRACT, POSIX profile, handbook 5/7/9, kernel-extensions strict-boot table,
  env appendix, developer-guide + scripts README, protocol/booter CHANGELOGs; hrpc allowlist schema
- Tests: hrpc allowlist, pear_doctor schema 2, split suffix, pipefail pipeline; fix PLACEHOLDER_BASELINE link

Pretest: refreshed kernel bins, man.json, posix dashboard, bundle health, seeder parity

kernel/bin/split

@@ -87,11 +87,28 @@ function bareOsEmitRaw(ctx, chunk) {
   return false
 }
 
+/**
+ * POSIX-style suffix: `aa`…`zz` (676 files), then `aaa`, `aab`, … as needed.
+ * @param {string} prefix
+ * @param {number} i 0-based output index
+ */
 function splitSuffix(prefix, i) {
   const a = 'abcdefghijklmnopqrstuvwxyz'
-  const hi = Math.floor(i / 26) % 26
-  const lo = i % 26
-  return prefix + a[hi] + a[lo]
+  let idx = i
+  let len = 2
+  let span = 26 ** len
+  while (idx >= span) {
+    idx -= span
+    len++
+    span = 26 ** len
+  }
+  let s = ''
+  let n = idx
+  for (let p = 0; p < len; p++) {
+    s = a[n % 26] + s
+    n = Math.floor(n / 26)
+  }
+  return prefix + s
 }
 
 async function run(ctx, argv) {