Complete the internal “100 task” roadmap: coreutils and shell parity (xargs,

sh, diff/patch, sort, printf, find, test, getfacl/setfacl/xattr), expanded
/proc and metrics (process table, syscalls, replication, net, security
posture, worker budget, swarm/replication hints), initd DAG supervision
metadata and richer restart journal telemetry, synthetic process groups via
IPC (assignProcessGroup/signalProcessGroup) mirrored into process_table,
optional kernel.ext.d incremental hot reload (BARE_OS_KERNEL_EXT_D_HOT_RELOAD)
with reload audit NDJSON, features proc for hyperblobs dedup and systemd
subset documentation, vault threat model doc plus posture fields for AEAD,
Pear enclave pointer, account rotation continuity, and Ed25519 consistency
across boot manifest / extensions / replication. Adds or extends tests and
keeps kernel/ and packages/bare-os-seeder/kernel/ in parity; guest init is
bundled from kernel/lib/init/init-main.js via bundle-kernel-init.

kernel/bin/mv

@@ -87,6 +87,15 @@ function bareOsEmitRaw(ctx, chunk) {
   return false
 }
 
+/**
+ * Move/rename via copy + delete. Hyperdrive has no single-key rename across paths, so
+ * directory trees and cross-location moves are duplicated then removed. A single regular
+ * file to a new non-directory path uses read + write + unlink when detected below.
+ *
+ * Documented limitations: cross-volume moves always copy+delete; EXDEV-style behavior is
+ * implicit. Busy targets, partial copy failures, and union read-only trees surface as
+ * generic errors from the VFS. Prefer same-directory renames for smallest blast radius.
+ */
 async function mvCopyPath(ctx, from, to, recursive, followSymlink) {
   const st = await ctx.vfs.lstat(from)
   if (!st) return false