feat: POSIX/P2P roadmap — multisig shape, socket bridge, bin index, docs

- Unify pear.multisig.json validation via bare-os-protocol + kernel boot fragment
- Socket bridge: SCM_RIGHTS path, ancillary handling, TCP half-close/shutdown how,
  connect tcpRecvQueue + poll/recv EOF and EPIPE-shaped errors
- Bin manifest / Hyperbee hints schema 2 + namesDigest; batch-write invalidation
- Host booter structured logging; BOOT_PERF_DETAIL bare_stdlib_merge_ns timing
- Wasm kernel optional syscall imports; security_posture rotation hints schema 2
- Shell errexit inside compound bodies; expand getconf/_SC_* and bareOsGetconfSysconf
- Subprocess bridge snapshot timeoutPolicy; blind-relay protomux backpressure tests
- Pear updater minimal delegate example + verify-pear scan; holepunch drift repos
- Refresh handbook, kernel-image, syscall-socket-contract, posix matrix, PEAR-RUN

Rebuild coreutils/bundles; bundle kernel; keep seeder/kernel parity.

docs/reference/README.md

@@ -45,7 +45,7 @@ This directory holds the split **file-by-file inventory** that used to live in t
 - **Placeholder / stub audit baseline** — [PLACEHOLDER_BASELINE.md](../audit/PLACEHOLDER_BASELINE.md)
 - **OTA and Bare/Pear bundles** — [OTA_AND_BUNDLES.md](../deployment/OTA_AND_BUNDLES.md)
 - **Environment variables and POSIX appendix** (former §14, §14a) — [Environment variables and POSIX appendix](environment-and-posix-appendix.md)
-- **Kernel feature bits and handshake** — [Kernel extensions](kernel-extensions.md)
+- **Kernel feature bits and handshake** — [Kernel extensions](kernel-extensions.md); source of truth for word masks — [`packages/bare-os-protocol/lib/kernel-feature-bits.js`](../../packages/bare-os-protocol/lib/kernel-feature-bits.js)
 - **Bits, env, `/proc`, and `ctx` map** — [Kernel capabilities index](kernel-capabilities-index.md)
 - **`ctx` API versioning** — [ctx-api-versioning.md](ctx-api-versioning.md)
 - **Version alignment** — [Compatibility matrix](compatibility-matrix.md)