feat(booter): complete P2P POSIX roadmap items and doc alignment

- ADRs under docs/adr/; KERNEL_CONTRACT + env appendix + handbook updates
- socketMsgSurface schema 5; replication_snapshot schema 2; syscall/example + tests
- MBR pacing docs/microbench; export mbrReadTimeoutMsForDisk; shell passthrough envs
- verify-ctx-api-feature-bits: syscall schema vs posix-compliance-matrix
- Wasm hostname import, disk.os snapshot hints, kernel-ext resolution docs
- coreutils nice + matrix/dashboard; syscalls.example ctxApiVersion 1.51.1
- Seeder kernel rsync parity; assorted booter/protocol doc fixes

kernel/lib/init/fragments/30-init-kernel-extensions.js

@@ -507,6 +507,38 @@ async function runKernelExtDropins(ctx, opts = {}) {
       return false
     }
   }
+  /** @param {string} ver */
+  function bareOsKernelExtSemverValid(ver) {
+    const s = String(ver || '').trim()
+    return /^[0-9]+\.[0-9]+\.[0-9]+(-[0-9A-Za-z.-]+)?(\+[0-9A-Za-z.-]+)?$/.test(
+      s
+    )
+  }
+  /** @type {string[]} */
+  const providesInvalidSemver = []
+  for (const e of collected) {
+    for (const pr of e.provides || []) {
+      if (!bareOsKernelExtSemverValid(pr.version)) {
+        providesInvalidSemver.push(`${e.extId}:${pr.name}@${pr.version}`)
+      }
+    }
+  }
+  providesInvalidSemver.sort()
+  if (providesInvalidSemver.length) {
+    bootStructuredLog(
+      ctx,
+      'warn',
+      'kernelExt.providesInvalidSemver',
+      `[kernel.ext.d] provides[].version must look like semver (major.minor.patch): ${providesInvalidSemver.join('; ')}`
+    )
+    if (strictPol) {
+      await appendKernelExtAuditNdjson(ctx, {
+        event: 'provides_invalid_semver',
+        items: providesInvalidSemver
+      })
+      return false
+    }
+  }
   /** @type {Map<string, { extId: string, version: string }>} */
   const provideNameToOwner = new Map()
   /** @type {string[]} */
@@ -613,20 +645,27 @@ async function runKernelExtDropins(ctx, opts = {}) {
     strictPol &&
     (ctx.env?.BARE_OS_BOOT_EXT_RESOLUTION_TRACE === '1' ||
       ctx.env?.BARE_OS_BOOT_EXT_RESOLUTION_TRACE === 'true')
+  const resolutionAlways =
+    ctx.env?.BARE_OS_KERNEL_EXT_RESOLUTION_JSON_ALWAYS === '1' ||
+    ctx.env?.BARE_OS_KERNEL_EXT_RESOLUTION_JSON_ALWAYS === 'true'
   const extResolutionFailure = strictPol && !topo.ok
   if (
     ctx.vfs &&
     typeof ctx.vfs.writeFile === 'function' &&
     ctx.b4a &&
-    (extResolutionFailure || traceOn)
+    (extResolutionFailure || traceOn || resolutionAlways)
   ) {
     try {
       const cycleSorted = topo.ok
         ? []
         : [...topo.cycleExtIds].sort((a, b) => a.localeCompare(b))
+      const provideSnapshot = {}
+      for (const [k, v] of provideNameToOwner) {
+        provideSnapshot[k] = v
+      }
       const body =
         JSON.stringify({
-          schema: 2,
+          schema: 3,
           atMs: Date.now(),
           sessionId: String((ctx.env && ctx.env.BARE_OS_SESSION_ID) || ''),
           bootPolicyStrict: !!strictPol,
@@ -640,9 +679,16 @@ async function runKernelExtDropins(ctx, opts = {}) {
           ordered: ordered.map((e) => ({
             extId: e.extId,
             file: e.file,
-            dependsOn: e.dependsOn
+            dependsOn: e.dependsOn,
+            provides: e.provides || []
           })),
-          cycleExtIds: topo.ok ? [] : cycleSorted
+          cycleExtIds: topo.ok ? [] : cycleSorted,
+          providesInvalidSemver,
+          providesVersionConflicts:
+            providesVersionConflicts.length > 0
+              ? providesVersionConflicts
+              : undefined,
+          provideNameToOwner: provideSnapshot
         }) + '\n'
       await ctx.vfs.writeFile(
         '/run/bare-os/kernel-ext-resolution.json',