feat: POSIX/P2P roadmap — proc surfaces, syscalls, boot perf, docs, CI

- Align posix-conformance-matrix bareOsSyscallOps with getconf BARE_OS_SYSCALL_OPS
- Add verify-boot-policy-extension-signer-pins.mjs to pretest; document in scripts/README
- Document extensionSignerPinsV2–V5 env wiring in OTA_AND_BUNDLES; vault multisig sketch
- Note telemetry NDJSON redaction limits in environment appendix
- Expand booter CHANGELOG 1.40.0 (boot-perf, shell POSIX mode, subprocess errors, etc.)
- Holepunch sync README: NDJSON summary path

Seeder/kernel parity and pretest already green for bundled changes.

docs/security/vault-multisig-continuity.md

@@ -0,0 +1,23 @@
+# Vault multi-device continuity (sketch)
+
+Bare OS identity today centers on **HDMS / autopass** flows documented in the handbook and users manual. **Optional multi-device continuity** (threshold approvals, device loss recovery) can follow Holepunch **hyper-multisig** / **pear-multisig-link** patterns without changing the default single-device vault.
+
+## Design constraints
+
+- **Backward compatible**: default **`/.bare/`** metadata and **`login` / `savevault`** flows keep working when multisig is off.
+- **Guest-visible only as hints**: synthetic **`/proc/bare_os`** JSON and host **`process.emit`** sketches — no silent network from the guest kernel.
+- **Operator-owned keys**: multisig public material is not embedded in the system image; distributors ship allowlists and boot policy pins.
+
+## Stock surfaces (today)
+
+| Surface | Role |
+|---------|------|
+| **`/proc/bare_os/hyper_multisig_trust_pointer.json`** | Operator-facing trust pointer sketch (see booter VFS proc table). |
+| **`/proc/bare_os/multisig_quorum_pointer.json`** | Quorum pointer sketch for dashboards. |
+| **`ctx.bareOsEmitMultisigPointer`**, **`ctx.bareOsMultisigQuorumPointer`** | Emit **`bare-os:multisig-pointer`** / **`bare-os:multisig-quorum-pointer`** on the host process for integrators. |
+| **`BARE_OS_HYPER_MULTISIG_VERIFY`** | Seeder can run **`hyper-multisig verify`** when the binary is on **`PATH`** (see [environment appendix](../reference/environment-and-posix-appendix.md)). |
+| **Boot policy** | **`extensionSignerPinsV2`**…**`V5`** pin extension signers; see [OTA and bundles](../deployment/OTA_AND_BUNDLES.md). Multisig is an **identity** layer above bundle trust. |
+
+## When to enable
+
+Use multisig operator flows when the host integrates **Holepunch multisig** tooling and documents pointer emission for your fleet — see [OTA and bundles](../deployment/OTA_AND_BUNDLES.md) and [identity handbook](../../handbook/05-identity-vault-and-hdms.md).