feat: complete 20-track kernel roadmap (P2P ops, POSIX, HRPC, CI, docs)

- Add optional Holepunch clone lag gate (holepunch-freshness-gate.json,
  verify-holepunch-clone-freshness.mjs) and wire into pretest/docs.
- Extend stock ctx.bareOsHrpcRequest with disk.os replication routes;
  bump hrpc_allowlist_sketch proc to schema 2 with stockRoutes list.
- Security posture: blindRelayAudit; hyper_multisig_trust_pointer schema 2
  + vault multisig continuity env; login/unlock audit hook.
- Syscalls schema 9 alignment (JSON schema, compatibility matrix, conformance
  matrix clock_gettime); boot budget telemetry schema 2 in metrics_live.
- Coreutils hostname -s/--short man/options; rebuild kernel bins/man.
- POSIX + P2P dashboard section in docs/README; handbook/DOCUMENTATION/
  release-checklist/OTA/KERNEL_CONTRACT/PEAR-RUN and related reference updates.
- verify-boot-policy-extension-signer-pins: scan kernel init fragments.

Note: vendor drift section removed from kernel/lib/bare/README.md (intentional).

docs/security/blind-relay-p2p-hardening.md

@@ -5,6 +5,7 @@ Bare OS follows a **zero-trust default** for **blind** Holepunch-style relays, *
 ## Operator controls
 
 - **`BARE_OS_PROC_BLIND_PEER_RELAY_HINTS`** — When set to **`1`** / **`true`** / **`yes`**, the booter may merge **non-secret** operator JSON from related **`BARE_OS_*`** env keys into those proc surfaces (see [`bare-os-pear-corestore-hrpc.js`](../../packages/bare-os-booter/lib/bare-os-proc-pear-corestore-hrpc.js) and companion proc builders).
+- **`BARE_OS_BLIND_RELAY_AUDIT_NDJSON`** — When **`1`** / **`true`**, **`/proc/bare_os/security_posture.json`** sets **`blindRelayAudit.armed`** so fleet automation knows blind-relay admission rows may be mirrored to host NDJSON sinks (still **no** peer keys in proc).
 - **Seed RPC** — Method names are **allowlisted** in [`seed-rpc-methods.js`](../../packages/bare-os-protocol/lib/seed-rpc-methods.js). Unknown methods fail closed with **`bare_os.rpc_unknown_method`**. Clients can mirror the same rule with **`bareOsIsAllowedSeedRpcMethodShort`** (exported from **`bare-os-protocol`**).
 - **Capabilities / handshake** — **`BARE_OS_SEED_CAP_STRICT`** and **`BARE_OS_SEED_CAP_FAIL`** tighten seeder capability checks; keep them aligned with your release train (see [compatibility matrix](../reference/compatibility-matrix.md)).
 

docs/security/vault-multisig-continuity.md

@@ -16,6 +16,8 @@ Bare OS identity today centers on **HDMS / autopass** flows documented in the ha
 | **`/proc/bare_os/multisig_quorum_pointer.json`** | Quorum pointer sketch for dashboards. |
 | **`ctx.bareOsEmitMultisigPointer`**, **`ctx.bareOsMultisigQuorumPointer`** | Emit **`bare-os:multisig-pointer`** / **`bare-os:multisig-quorum-pointer`** on the host process for integrators. |
 | **`BARE_OS_HYPER_MULTISIG_VERIFY`** | Seeder can run **`hyper-multisig verify`** when the binary is on **`PATH`** (see [environment appendix](../reference/environment-and-posix-appendix.md)). |
+| **`BARE_OS_VAULT_MULTISIG_CONTINUITY_JSON`** | Merged into **`hyper_multisig_trust_pointer.json`** (**schema 2**) as **`vaultMultisigContinuity`** — operator-owned continuity sketch only. |
+| **`BARE_OS_VAULT_MULTISIG_CONTINUITY_AUDIT_NDJSON`** | When **`1`** / **`true`**, login / unlock appends a **`vault.multisig_continuity_login_sketch`** audit row (**public-key hex prefix** only). |
 | **Boot policy** | **`extensionSignerPinsV2`**…**`V5`** pin extension signers; see [OTA and bundles](../deployment/OTA_AND_BUNDLES.md). Multisig is an **identity** layer above bundle trust. |
 
 ## When to enable