CI/docs: placeholder-baseline --check, seeder↔kernel sync script and docs,

holepunch lockfile drift Markdown dashboard + doc links
- disk.os / ctx: replication_operator_sketch schema 5 + corestore stats;
  protomux extensions proc versioning; HRPC allowlist_sketch schema 3 +
  versioned stock route table; swarm_health proc + runtime caps paths
- Session: BARE_OS_HOSTNAME_SET + ctx.bareOsSetSessionHostname, hostname man,
  security_posture; export -p in shell
- kernel.ext.d: optional provides[] version conflict detection (strict boot);
  resolver parity + tests; BARE_OS_INIT_DEFER_KERNEL_EXT_GRAPH documented
- VFS/policy: mirror/aux read tests, GUEST_BARE_READ_ALL edge negative test;
  adaptive warm-cache window env documented; microbench note
- POSIX: syscalls.json schema 10, posix_fadvise no-op, getconf + conformance
  matrix sync; posix-issue7-traceability index; handbook/profile/matrix updates
- Seeder: pear.multisig hint tests; SCM_RIGHTS unit coverage extended
- Regenerated kernel bundle, seeder kernel mirror, posix dashboard, coreutils
  build/man; booter CHANGELOG maintenance row updated
Full npm test / pretest green.

docs/deployment/OTA_AND_BUNDLES.md

@@ -22,6 +22,7 @@ Bare OS aligns with the **Holepunch** toolchain for shipping JavaScript as **Bar
 - **Warm cache + proc**: **`bareOsVfsBatchWrite`** clears **`/bin`** / **`/lib/bare`** warm read caches and increments **`vfs.warm_read_cache_invalidate_batch`**; the same path clears the **cached** **`/proc/bare_os/syscalls.json`** text so replication swaps cannot serve stale syscall metadata. With **`BARE_OS_VFS_WARM_CACHE_INVALIDATE_ON_REPLICATION`**, core-length growth triggers **`ctx.bareOsInvalidateWarmReadCaches('replication:core-length')`** and increments **`vfs.replication_warm_full_invalidate`** in **`kernelCounters`**. **`ctx.bareOsCorestoreSnapshotHint()`** increments **`operator.corestore_snapshot_hint`** for operator dashboards.
 - **Corestore snapshot E2E**: host/seeder tooling may set **`BARE_OS_SEED_CORESTORE_SNAPSHOT_TAG`**, **`BARE_OS_SEED_SNAPSHOT_HINTS_JSON`**, **`BARE_OS_CORESTORE_SNAPSHOT_STATE_JSON`**, and **`BARE_OS_CORESTORE_SNAPSHOT_PAUSED`**; the stock booter mirrors a bounded sketch under **`/proc/bare_os/corestore_snapshot.json`** (wave-6 replication operator surface) and **`disk.os` `replication_operator_sketch`** **`corestoreSnapshotPaused`**. Guests read hints only — cutover verification stays on the host.
 - **Hyperblobs / dedup**: when **`BARE_OS_VFS_HYPERBLOBS_DEDUP`** is enabled, operators may supply **`BARE_OS_HYPERBLOBS_STATS_JSON`**; the booter merges **`hyperblobsDedupSketch`** into **`disk.os` `replication_operator_sketch`** for fleet dashboards (no guest chunking).
+- **Corestore operator stats**: optional **`BARE_OS_CORESTORE_STATS_JSON`** merges **`corestoreOperatorSketch`** into **`replication_operator_sketch`** (**schema 5**); keep payloads non-secret (counts and hints only).
 - **Local Holepunch clones**: after patching **`bare-*`** sources from a local **`holepunchto_repos`** checkout, rebuild with **`npm run build -w bare-os-bare-libs`**, mirror **`kernel/`** → **`packages/bare-os-seeder/kernel/`**, refresh **`docs/audit/bundle-health.json`**, and re-run **`npm test`** (see **[`kernel/lib/bare/README.md`](../../kernel/lib/bare/README.md)**).
 - **Extension signer pins**: when **`BARE_OS_BOOT_POLICY=1`**, the stock kernel copies **`extensionSignerPinsV2`**…**`V5`** from **`boot.policy`** into **`ctx.env`** as **`BARE_OS_BOOT_POLICY_EXTENSION_SIGNER_PINS_V2_JSON`** … **`_V5_JSON`** (stringified objects). Treat pin churn like ABI bumps — run **`npm run pretest`** (**`verify-boot-policy-extension-signer-pins.mjs`**, extension manifest schema, capability verifiers) after edits.