Complete the internal “100 task” roadmap: coreutils and shell parity (xargs,

sh, diff/patch, sort, printf, find, test, getfacl/setfacl/xattr), expanded
/proc and metrics (process table, syscalls, replication, net, security
posture, worker budget, swarm/replication hints), initd DAG supervision
metadata and richer restart journal telemetry, synthetic process groups via
IPC (assignProcessGroup/signalProcessGroup) mirrored into process_table,
optional kernel.ext.d incremental hot reload (BARE_OS_KERNEL_EXT_D_HOT_RELOAD)
with reload audit NDJSON, features proc for hyperblobs dedup and systemd
subset documentation, vault threat model doc plus posture fields for AEAD,
Pear enclave pointer, account rotation continuity, and Ed25519 consistency
across boot manifest / extensions / replication. Adds or extends tests and
keeps kernel/ and packages/bare-os-seeder/kernel/ in parity; guest init is
bundled from kernel/lib/init/init-main.js via bundle-kernel-init.

scripts/verify-bare-imports.mjs

@@ -3,7 +3,8 @@
  * CI: forbid `node:` specifiers in Bare OS runtime sources (booter + guest kernel +
  * bare-os-protocol lib). Repo maintenance scripts under scripts/ may use node:.
  * Dual booter files `*.node.js` are excluded (Node-only shims).
- * `kernel/lib/bare/bundles/` is never walked (vendored IIFEs).
+ * `kernel/lib/bare/bundles/*.js` are scanned for forbidden `node:` requires
+ * (guest-shipped IIFEs must use bare-* only).
  */
 import fs from 'node:fs'
 import path from 'node:path'
@@ -65,13 +66,21 @@ function checkFile(abs) {
 
 function main() {
   const protocolLib = path.join(root, 'packages', 'bare-os-protocol', 'lib')
+  const bundleDir = path.join(root, 'kernel', 'lib', 'bare', 'bundles')
+  const bundleFiles = fs.existsSync(bundleDir)
+    ? fs
+        .readdirSync(bundleDir)
+        .filter((n) => n.endsWith('.js'))
+        .map((n) => path.join(bundleDir, n))
+    : []
   const files = [
     path.join(root, 'kernel', 'init.js'),
     path.join(root, 'kernel', 'lib', 'init', 'init-main.js'),
     ...walk(path.join(root, 'kernel', 'lib', 'boot')),
     ...walk(path.join(root, 'packages', 'bare-os-booter', 'lib')),
     path.join(root, 'packages', 'bare-os-booter', 'index.js'),
-    ...(fs.existsSync(protocolLib) ? walk(protocolLib) : [])
+    ...(fs.existsSync(protocolLib) ? walk(protocolLib) : []),
+    ...bundleFiles
   ]
   for (const abs of files) {
     if (!fs.existsSync(abs)) continue