feat: POSIX/P2P roadmap — proc surfaces, syscalls, boot perf, docs, CI

- Align posix-conformance-matrix bareOsSyscallOps with getconf BARE_OS_SYSCALL_OPS
- Add verify-boot-policy-extension-signer-pins.mjs to pretest; document in scripts/README
- Document extensionSignerPinsV2–V5 env wiring in OTA_AND_BUNDLES; vault multisig sketch
- Note telemetry NDJSON redaction limits in environment appendix
- Expand booter CHANGELOG 1.40.0 (boot-perf, shell POSIX mode, subprocess errors, etc.)
- Holepunch sync README: NDJSON summary path

Seeder/kernel parity and pretest already green for bundled changes.

kernel/etc/bare-os/syscalls.example.json

@@ -1,9 +1,9 @@
 {
   "schemaVersion": 5,
-  "ctxApiVersion": "1.38.0",
+  "ctxApiVersion": "1.40.0",
   "posixProfile": {
     "id": "bare-os-posix-like",
-    "version": "1.0.4"
+    "version": "1.0.5"
   },
   "ops": ["readFile", "writeFile", "socket"],
   "opsDetail": [
@@ -29,7 +29,7 @@
   "posixXsh": {
     "schema": 1,
     "note": "POSIX.1 XSH-style names; socket family are ctx.bareOsSyscall ops returning ENOSYS-shaped results.",
-    "namesCsv": "open,close,read,write,lseek,pipe,dup,dup2,fcntl,poll,select,umask,socket,bind,listen,accept,connect,send,recv,shutdown"
+    "namesCsv": "open,close,read,write,readv,writev,getsockopt,setsockopt,lseek,pipe,dup,dup2,fcntl,poll,select,umask,socket,bind,listen,accept,connect,send,recv,shutdown"
   },
   "errnoHints": {
     "ENOENT": 2,
@@ -42,7 +42,7 @@
     "stdio": [0, 1, 2],
     "register": "ctx.bareOsRegisterLogicalFd",
     "processTablePath": "/proc/bare_os/process_table.json",
-    "processTableSchema": 5
+    "processTableSchema": 6
   },
   "signalModel": {
     "schema": 1,