feat(booter): harden guest vs user isolation and POSIX/P2P parity

- Guest-safe legacy personal-root migration with state file and env gates
- VFS guest deny for sensitive /.bare paths; warm-cache clear on identity switch
- Optional acct/<hash>/ personal layout, guest scrub, vault exclude alignment
- Shell session reset + errexit; fish history reload hook; replication metric
- Audit NDJSON for migration/scrub; structured booter logging paths
- Bump POSIX profile; getconf keys; syscall/socket contract + handbook/docs pass
- Booter tests (Bare vs Node split for identity-session); release-checklist audit hook

DOCUMENTATION.md

@@ -29,7 +29,7 @@ Start at the **[documentation home](docs/README.md)** for role-based navigation
 - **Former §9** — [docs/reference/kernel-image.md](docs/reference/kernel-image.md)
 - **Former §10** — [docs/reference/package-bare-os-protocol.md](docs/reference/package-bare-os-protocol.md)
 - **Former §11** — [docs/reference/package-bare-os-seeder.md](docs/reference/package-bare-os-seeder.md)
-- **Former §§12.1–12.9** — [docs/reference/package-bare-os-booter.md](docs/reference/package-bare-os-booter.md)
+- **Former §§12.1–12.9** — [docs/reference/package-bare-os-booter.md](docs/reference/package-bare-os-booter.md) (guest **`/.bare`** policy, **`BARE_OS_PERSONAL_*`** migration/acct env — [environment appendix](docs/reference/environment-and-posix-appendix.md))
 - **Former §§12.10–12.12** — [docs/reference/package-bare-os-coreutils-and-ci.md](docs/reference/package-bare-os-coreutils-and-ci.md)
 - **Former §13** — [docs/reference/architecture-data-flow.md](docs/reference/architecture-data-flow.md)
 - **Former §14, §14a** — [docs/reference/environment-and-posix-appendix.md](docs/reference/environment-and-posix-appendix.md)