feat: POSIX/P2P roadmap — proc surfaces, syscalls, boot perf, docs, CI

- Align posix-conformance-matrix bareOsSyscallOps with getconf BARE_OS_SYSCALL_OPS
- Add verify-boot-policy-extension-signer-pins.mjs to pretest; document in scripts/README
- Document extensionSignerPinsV2–V5 env wiring in OTA_AND_BUNDLES; vault multisig sketch
- Note telemetry NDJSON redaction limits in environment appendix
- Expand booter CHANGELOG 1.40.0 (boot-perf, shell POSIX mode, subprocess errors, etc.)
- Holepunch sync README: NDJSON summary path

Seeder/kernel parity and pretest already green for bundled changes.

docs/reference/posix-conformance-matrix.json

@@ -20,6 +20,7 @@
     "fsync",
     "ftruncate",
     "getcwd",
+    "getsockopt",
     "kill",
     "link",
     "listen",
@@ -31,11 +32,13 @@
     "readFile",
     "readdir",
     "readlink",
+    "readv",
     "recv",
     "rename",
     "rmdir",
     "select",
     "send",
+    "setsockopt",
     "shutdown",
     "socket",
     "stat",
@@ -45,7 +48,8 @@
     "umount",
     "unlink",
     "utimes",
-    "writeFile"
+    "writeFile",
+    "writev"
   ],
   "utilitiesRecent": [
     "dd",