feat: POSIX/P2P roadmap — proc surfaces, syscalls, boot perf, docs, CI

- Align posix-conformance-matrix bareOsSyscallOps with getconf BARE_OS_SYSCALL_OPS
- Add verify-boot-policy-extension-signer-pins.mjs to pretest; document in scripts/README
- Document extensionSignerPinsV2–V5 env wiring in OTA_AND_BUNDLES; vault multisig sketch
- Note telemetry NDJSON redaction limits in environment appendix
- Expand booter CHANGELOG 1.40.0 (boot-perf, shell POSIX mode, subprocess errors, etc.)
- Holepunch sync README: NDJSON summary path

Seeder/kernel parity and pretest already green for bundled changes.

docs/CONTRIBUTING-DOCS.md

@@ -71,6 +71,7 @@ If you must quote a banned substring for wire-compat or third-party context, add
 
 - **Version fields, offsets, feature bits, matrix tables:** update the **reference** page or JSON first; narrative chapters should link to it.
 - **`bareOsCtxApiVersion`:** history in [packages/bare-os-booter/CHANGELOG.md](../packages/bare-os-booter/CHANGELOG.md); summary row in [docs/reference/compatibility-matrix.md](reference/compatibility-matrix.md).
+- **POSIX matrix → dashboard:** edit [`docs/reference/posix-compliance-matrix.json`](reference/posix-compliance-matrix.json); [`docs/reference/posix-dashboard.md`](reference/posix-dashboard.md) is generated by [`scripts/gen-posix-dashboard.mjs`](../scripts/gen-posix-dashboard.mjs) and checked by [`scripts/verify-posix-dashboard.mjs`](../scripts/verify-posix-dashboard.mjs) during **`npm run pretest`**.
 
 ---