feat(booter): ctx 1.54.0, process table v9, and Holepunch/POSIX proc parity

- Bump BARE_OS_CTX_API_VERSION to 1.54.0 and POSIX profile to 1.0.19
- Process table schema 9: nice/accountingSource, logical maps/threads /proc builders, renice
- disk.os: replication_operator_sketch v8, HyperDHT address sketch, pkg index surfaces
- Protomux operator sketch v4, security_posture v7, corestore snapshot UX hint, pear_stage_pointer v2
- Swarm: BARE_OS_SWARM_ATTEMPT_BURST_PER_SEC; HDMS: host booter warn logging; shell wait exit codes
- getconf/sysconf: additional _SC_* via bareOsGetconfSysconf; socketMsgSurface v6 (iovec/SUSv4 refs)
- Identity: vault rotation audit includes pathcap trusted key count
- CI/docs: holepunch drift report env, kernel STRUCTURE note, verify-bundle-throws comment, matrices and examples

scripts/verify-bundle-throws.mjs

@@ -4,6 +4,7 @@
  * look like incomplete implementations (complements verify-bundle-markers.mjs). Allowlist entries
  * carry rationale. This is **not** the same gate as verify-runtime-no-incomplete-markers.mjs, which
  * applies only to first-party kernel + booter sources — see developer-guide/node-to-bare-modules.md.
+ * HTTP stacks may retain **`bareOsHttp501Factory("Method not implemented")`** patterns after `sanitize-bare-bundles.mjs`; those are **501 factories**, not kernel TODOs — do not add them to the throw allowlist unless upstream reintroduces raw abstract throws.
  *
  * Matches: throw new Error("…"), cb(new Error("…")), emit("error", new Error("…")), etc.
  */

scripts/verify-holepunch-clone-drift.mjs

@@ -161,6 +161,33 @@ function main() {
     )
     process.exit(1)
   }
+  const writeReport =
+    process.env.BARE_OS_HOLEPUNCH_DRIFT_WRITE_REPORT === '1' ||
+    process.env.BARE_OS_HOLEPUNCH_DRIFT_WRITE_REPORT === 'true'
+  if (writeReport) {
+    const outMd = path.join(root, 'docs/audit/holepunch-drift-last-run.md')
+    const lines = [
+      '# Holepunch clone drift (last verify)',
+      '',
+      `Generated: ${new Date().toISOString()}`,
+      '',
+      'All listed clones were at or ahead of `origin/main` when this file was written.',
+      '',
+      `Mode: ${tier1 ? 'tier1Repos[]' : 'repos[]'}`,
+      '',
+      'Repos checked:',
+      ...repos.map((n) => `- ${n}`),
+      '',
+      'Re-run: `BARE_OS_HOLEPUNCH_DRIFT_WRITE_REPORT=1 npm run pretest` (or run this script directly after `git fetch`).',
+      ''
+    ]
+    try {
+      fs.mkdirSync(path.dirname(outMd), { recursive: true })
+      fs.writeFileSync(outMd, lines.join('\n'), 'utf8')
+    } catch (e) {
+      console.warn('verify-holepunch-clone-drift: could not write report', e)
+    }
+  }
   console.log('verify-holepunch-clone-drift: OK')
 }