feat(booter): ctx 1.54.0, process table v9, and Holepunch/POSIX proc parity

- Bump BARE_OS_CTX_API_VERSION to 1.54.0 and POSIX profile to 1.0.19
- Process table schema 9: nice/accountingSource, logical maps/threads /proc builders, renice
- disk.os: replication_operator_sketch v8, HyperDHT address sketch, pkg index surfaces
- Protomux operator sketch v4, security_posture v7, corestore snapshot UX hint, pear_stage_pointer v2
- Swarm: BARE_OS_SWARM_ATTEMPT_BURST_PER_SEC; HDMS: host booter warn logging; shell wait exit codes
- getconf/sysconf: additional _SC_* via bareOsGetconfSysconf; socketMsgSurface v6 (iovec/SUSv4 refs)
- Identity: vault rotation audit includes pathcap trusted key count
- CI/docs: holepunch drift report env, kernel STRUCTURE note, verify-bundle-throws comment, matrices and examples

packages/bare-os-booter/lib/bare-os-swarm-peer-policy.js

@@ -79,6 +79,8 @@ export class BareOsSwarmPeerPolicyEngine {
     this._peers = new Map()
     /** @type {number} */
     this._globalReconnectBudget = 256
+    /** @type {{ start: number, n: number } | null} */
+    this._attemptBurstWindow = null
   }
 
   _key(peerKey) {
@@ -158,6 +160,15 @@ export class BareOsSwarmPeerPolicyEngine {
     if (this._env) {
       const adm = evaluateBareOsPeerAdmission(this._env, k, meta)
       if (adm.verdict === 'deny') return false
+      const burstMax = Number.parseInt(
+        String(this._env.BARE_OS_SWARM_ATTEMPT_BURST_PER_SEC || ''),
+        10
+      )
+      if (Number.isFinite(burstMax) && burstMax > 0) {
+        const now = Date.now()
+        const w = this._attemptBurstWindow
+        if (w && now - w.start <= 1000 && w.n >= burstMax) return false
+      }
     }
     const st = this._peers.get(k)
     const now = Date.now()
@@ -176,6 +187,22 @@ export class BareOsSwarmPeerPolicyEngine {
     const st = this._getOrCreate(k)
     if (st.reconnectBudget > 0) st.reconnectBudget--
     if (this._globalReconnectBudget > 0) this._globalReconnectBudget--
+    if (this._env) {
+      const burstMax = Number.parseInt(
+        String(this._env.BARE_OS_SWARM_ATTEMPT_BURST_PER_SEC || ''),
+        10
+      )
+      if (Number.isFinite(burstMax) && burstMax > 0) {
+        const now = Date.now()
+        if (
+          !this._attemptBurstWindow ||
+          now - this._attemptBurstWindow.start > 1000
+        ) {
+          this._attemptBurstWindow = { start: now, n: 0 }
+        }
+        this._attemptBurstWindow.n++
+      }
+    }
   }
 
   /**
@@ -215,6 +242,10 @@ export class BareOsSwarmPeerPolicyEngine {
     return {
       schema: 2,
       cfg: { ...this._cfg },
+      attemptBurstEnv: 'BARE_OS_SWARM_ATTEMPT_BURST_PER_SEC',
+      attemptBurstWindow: this._attemptBurstWindow
+        ? { ...this._attemptBurstWindow }
+        : null,
       globalReconnectBudget: this._globalReconnectBudget,
       peers: [...this._peers.entries()].map(([id, st]) => ({
         id,