feat(booter): harden guest vs user isolation and POSIX/P2P parity

- Guest-safe legacy personal-root migration with state file and env gates
- VFS guest deny for sensitive /.bare paths; warm-cache clear on identity switch
- Optional acct/<hash>/ personal layout, guest scrub, vault exclude alignment
- Shell session reset + errexit; fish history reload hook; replication metric
- Audit NDJSON for migration/scrub; structured booter logging paths
- Bump POSIX profile; getconf keys; syscall/socket contract + handbook/docs pass
- Booter tests (Bare vs Node split for identity-session); release-checklist audit hook

packages/bare-os-coreutils/src/getconf.js

@@ -94,7 +94,15 @@ const CONF = {
   /** Operator hint for hyperblob-style dedup in host pipelines; guest VFS does not enable automatically. */
   BARE_OS_VFS_HYPERBLOBS_DEDUP: '0',
   /** This binary: fixed catalog. Use `getconf NAME /path` + `ctx.bareOsPathconf` for live pathconf. */
-  BARE_OS_GETCONF_SOURCE: 'static_catalog'
+  BARE_OS_GETCONF_SOURCE: 'static_catalog',
+  /** Guest session denies read/write/unlink/chmod on sealed `/.bare/account` and `/.bare/vault/**` unless BARE_OS_GUEST_BARE_READ_ALL=1. */
+  BARE_OS_GUEST_SENSITIVE_BARE_DENY: '1',
+  /** Optional `/.bare-os/acct/…` segment before `home/` and `tmp/` (BARE_OS_PERSONAL_ACCT_PREFIX). */
+  BARE_OS_PERSONAL_ACCT_PREFIX_FEATURE: '1',
+  /** Legacy flat-root → `/.bare-os/home/<seg>/` migration state file on the personal drive. */
+  BARE_OS_PERSONAL_ROOT_MIGRATION_STATE: '/.bare-os/migration/legacy-root-v1.json',
+  /** Replication hook counter: vfs.replication_warm_full_invalidate (metrics / kernelCounters). */
+  BARE_OS_REPLICATION_WARM_FULL_INVALIDATE_METRIC: 'vfs.replication_warm_full_invalidate'
 }
 
 async function run(ctx, argv) {