CI/docs: placeholder-baseline --check, seeder↔kernel sync script and docs,

holepunch lockfile drift Markdown dashboard + doc links
- disk.os / ctx: replication_operator_sketch schema 5 + corestore stats;
  protomux extensions proc versioning; HRPC allowlist_sketch schema 3 +
  versioned stock route table; swarm_health proc + runtime caps paths
- Session: BARE_OS_HOSTNAME_SET + ctx.bareOsSetSessionHostname, hostname man,
  security_posture; export -p in shell
- kernel.ext.d: optional provides[] version conflict detection (strict boot);
  resolver parity + tests; BARE_OS_INIT_DEFER_KERNEL_EXT_GRAPH documented
- VFS/policy: mirror/aux read tests, GUEST_BARE_READ_ALL edge negative test;
  adaptive warm-cache window env documented; microbench note
- POSIX: syscalls.json schema 10, posix_fadvise no-op, getconf + conformance
  matrix sync; posix-issue7-traceability index; handbook/profile/matrix updates
- Seeder: pear.multisig hint tests; SCM_RIGHTS unit coverage extended
- Regenerated kernel bundle, seeder kernel mirror, posix dashboard, coreutils
  build/man; booter CHANGELOG maintenance row updated
Full npm test / pretest green.

kernel/bin/hostname

@@ -95,11 +95,28 @@ async function run(ctx, argv) {
     'bare-os'
   h = String(h)
   let shortOnly = false
+  let setName = null
   for (let i = 1; i < argv.length; i++) {
     const a = String(argv[i] || '')
     if (a === '-s' || a === '--short') shortOnly = true
     else if (a === '-f' || a === '--fqdn') shortOnly = false
-    else if (a === '--') break
+    else if (a === '-S' || a === '--set') {
+      setName = String(argv[++i] || '').trim()
+      break
+    } else if (a === '--') break
+  }
+  if (setName != null) {
+    if (
+      typeof ctx.bareOsSetSessionHostname === 'function' &&
+      (ctx.env?.BARE_OS_HOSTNAME_SET === '1' ||
+        ctx.env?.BARE_OS_HOSTNAME_SET === 'true')
+    ) {
+      ctx.bareOsSetSessionHostname(setName)
+      return
+    }
+    throw new Error(
+      'hostname: setting disabled (require BARE_OS_HOSTNAME_SET=1 and ctx.bareOsSetSessionHostname)'
+    )
   }
   if (shortOnly) {
     const dot = h.indexOf('.')