feat(booter): complete P2P POSIX roadmap items and doc alignment

- ADRs under docs/adr/; KERNEL_CONTRACT + env appendix + handbook updates
- socketMsgSurface schema 5; replication_snapshot schema 2; syscall/example + tests
- MBR pacing docs/microbench; export mbrReadTimeoutMsForDisk; shell passthrough envs
- verify-ctx-api-feature-bits: syscall schema vs posix-compliance-matrix
- Wasm hostname import, disk.os snapshot hints, kernel-ext resolution docs
- coreutils nice + matrix/dashboard; syscalls.example ctxApiVersion 1.51.1
- Seeder kernel rsync parity; assorted booter/protocol doc fixes

users-manual/05-home-identity-and-vault.md

@@ -32,6 +32,8 @@ After a successful login, **`HOME`** moves under **`/home/<public-key-prefix>`**
 
 Cryptographic details are implementation-specific; this manual stays at the behavior level. For prose-level crypto and flow diagrams, read [Handbook — Chapter 5](../handbook/05-identity-vault-and-hdms.md).
 
+**Threat-model hint:** **`/proc/bare_os/security_posture.json`** lists **`vaultCryptoPrimitives`** (algorithms the booter uses around vault-era material) and **`bareCryptoReportedVersion`** (resolved **`bare-crypto`** version). Compare these to your deployment policy when auditing upgrades — they contain **no** keys or ciphertext.
+
 ```mermaid
 stateDiagram-v2
   [*] --> Guest