feat: complete 20-track kernel roadmap (P2P ops, POSIX, HRPC, CI, docs)

- Add optional Holepunch clone lag gate (holepunch-freshness-gate.json,
  verify-holepunch-clone-freshness.mjs) and wire into pretest/docs.
- Extend stock ctx.bareOsHrpcRequest with disk.os replication routes;
  bump hrpc_allowlist_sketch proc to schema 2 with stockRoutes list.
- Security posture: blindRelayAudit; hyper_multisig_trust_pointer schema 2
  + vault multisig continuity env; login/unlock audit hook.
- Syscalls schema 9 alignment (JSON schema, compatibility matrix, conformance
  matrix clock_gettime); boot budget telemetry schema 2 in metrics_live.
- Coreutils hostname -s/--short man/options; rebuild kernel bins/man.
- POSIX + P2P dashboard section in docs/README; handbook/DOCUMENTATION/
  release-checklist/OTA/KERNEL_CONTRACT/PEAR-RUN and related reference updates.
- verify-boot-policy-extension-signer-pins: scan kernel init fragments.

Note: vendor drift section removed from kernel/lib/bare/README.md (intentional).

docs/deployment/OTA_AND_BUNDLES.md

@@ -20,6 +20,8 @@ Bare OS aligns with the **Holepunch** toolchain for shipping JavaScript as **Bar
 - **Ctx / API semver**: bump **`BARE_OS_CTX_API_VERSION`** when guest-visible `ctx` behavior changes; record it in [compatibility-matrix.md](../reference/compatibility-matrix.md).
 - **Offline / LKG**: document **`BARE_OS_OFFLINE_LKG_BOOT`** and related env in [environment appendix](../reference/environment-and-posix-appendix.md).
 - **Warm cache + proc**: **`bareOsVfsBatchWrite`** clears **`/bin`** / **`/lib/bare`** warm read caches and increments **`vfs.warm_read_cache_invalidate_batch`**; the same path clears the **cached** **`/proc/bare_os/syscalls.json`** text so replication swaps cannot serve stale syscall metadata. With **`BARE_OS_VFS_WARM_CACHE_INVALIDATE_ON_REPLICATION`**, core-length growth triggers **`ctx.bareOsInvalidateWarmReadCaches('replication:core-length')`** and increments **`vfs.replication_warm_full_invalidate`** in **`kernelCounters`**. **`ctx.bareOsCorestoreSnapshotHint()`** increments **`operator.corestore_snapshot_hint`** for operator dashboards.
+- **Corestore snapshot E2E**: host/seeder tooling may set **`BARE_OS_SEED_CORESTORE_SNAPSHOT_TAG`**, **`BARE_OS_SEED_SNAPSHOT_HINTS_JSON`**, **`BARE_OS_CORESTORE_SNAPSHOT_STATE_JSON`**, and **`BARE_OS_CORESTORE_SNAPSHOT_PAUSED`**; the stock booter mirrors a bounded sketch under **`/proc/bare_os/corestore_snapshot.json`** (wave-6 replication operator surface) and **`disk.os` `replication_operator_sketch`** **`corestoreSnapshotPaused`**. Guests read hints only — cutover verification stays on the host.
+- **Hyperblobs / dedup**: when **`BARE_OS_VFS_HYPERBLOBS_DEDUP`** is enabled, operators may supply **`BARE_OS_HYPERBLOBS_STATS_JSON`**; the booter merges **`hyperblobsDedupSketch`** into **`disk.os` `replication_operator_sketch`** for fleet dashboards (no guest chunking).
 - **Local Holepunch clones**: after patching **`bare-*`** sources from a local **`holepunchto_repos`** checkout, rebuild with **`npm run build -w bare-os-bare-libs`**, mirror **`kernel/`** → **`packages/bare-os-seeder/kernel/`**, refresh **`docs/audit/bundle-health.json`**, and re-run **`npm test`** (see **[`kernel/lib/bare/README.md`](../../kernel/lib/bare/README.md)**).
 - **Extension signer pins**: when **`BARE_OS_BOOT_POLICY=1`**, the stock kernel copies **`extensionSignerPinsV2`**…**`V5`** from **`boot.policy`** into **`ctx.env`** as **`BARE_OS_BOOT_POLICY_EXTENSION_SIGNER_PINS_V2_JSON`** … **`_V5_JSON`** (stringified objects). Treat pin churn like ABI bumps — run **`npm run pretest`** (**`verify-boot-policy-extension-signer-pins.mjs`**, extension manifest schema, capability verifiers) after edits.