feat(kernel): wave 2 guest OS surface and operator parity

- Extend capability model (featureBits2) and align ADR, protocol, /proc, verify scripts
- Add seed RPC + /proc mirrors for replication queue, MBR failover hints, optional attestation
- Pear bridge: IPC request/response, mirror-drive / HDMS pairing hints, dev diagnostics
- Initd: IdleSec for socket units, units.d drop-ins, richer readiness (e.g. exec:)
- Cron: @reboot and JitterSec-style scheduling
- VFS: Linux-shaped /proc stubs (cgroups, tcp), bounded vfs.watch on safe pseudo paths
- Shell: gated parameter expansion v2; /bin/env -S and --env-file (staged script without ESM export)
- Schemas under docs/schemas; expand contract tests; kernel.ext.d → /proc extensions registry
- Refresh handbook, developer-guide, reference index, package READMEs; keep seeder kernel tree in sync

scripts/verify-ctx-api-feature-bits.mjs

@@ -44,12 +44,20 @@ function main() {
     console.error('index.js should reference BARE_OS_KERNEL_FEATURES_STOCK_V1')
     process.exit(1)
   }
+  if (!idx.includes('BARE_OS_KERNEL_FEATURES_STOCK_V2')) {
+    console.error('index.js should reference BARE_OS_KERNEL_FEATURES_STOCK_V2')
+    process.exit(1)
+  }
 
   const bitsSrc = read(bitsPath)
   if (!bitsSrc.includes('export const BARE_OS_KERNEL_FEATURES_STOCK_V1')) {
     console.error('kernel-feature-bits.js missing BARE_OS_KERNEL_FEATURES_STOCK_V1')
     process.exit(1)
   }
+  if (!bitsSrc.includes('export const BARE_OS_KERNEL_FEATURES_STOCK_V2')) {
+    console.error('kernel-feature-bits.js missing BARE_OS_KERNEL_FEATURES_STOCK_V2')
+    process.exit(1)
+  }
   const docMatch = bitsSrc.match(
     /export const BARE_OS_KERNEL_FEATURE_BITS_DOC = (\d+)/
   )