feat(booter): harden guest vs user isolation and POSIX/P2P parity

- Guest-safe legacy personal-root migration with state file and env gates
- VFS guest deny for sensitive /.bare paths; warm-cache clear on identity switch
- Optional acct/<hash>/ personal layout, guest scrub, vault exclude alignment
- Shell session reset + errexit; fish history reload hook; replication metric
- Audit NDJSON for migration/scrub; structured booter logging paths
- Bump POSIX profile; getconf keys; syscall/socket contract + handbook/docs pass
- Booter tests (Bare vs Node split for identity-session); release-checklist audit hook

docs/design/multi-account-personal-subvolumes.md

@@ -1,6 +1,6 @@
 # Multi-account personal subvolumes (design)
 
-**Status:** phased design — stock Bare OS remains **single-session** today.
+**Status:** phase **1** implemented — optional **`BARE_OS_PERSONAL_ACCT_PREFIX=1`** nests **`home`**, **`tmp`**, and **`var/log`** session subtrees under **`/.bare-os/acct/<id>/`** on the personal drive (see [`vfs-path-classes.md`](../reference/vfs-path-classes.md)). Single interactive session per boot remains the stock model; this is a **layout** hook for future multi-account handoff.
 
 ## Goals