feat: complete 20-track kernel roadmap (P2P ops, POSIX, HRPC, CI, docs)

- Add optional Holepunch clone lag gate (holepunch-freshness-gate.json,
  verify-holepunch-clone-freshness.mjs) and wire into pretest/docs.
- Extend stock ctx.bareOsHrpcRequest with disk.os replication routes;
  bump hrpc_allowlist_sketch proc to schema 2 with stockRoutes list.
- Security posture: blindRelayAudit; hyper_multisig_trust_pointer schema 2
  + vault multisig continuity env; login/unlock audit hook.
- Syscalls schema 9 alignment (JSON schema, compatibility matrix, conformance
  matrix clock_gettime); boot budget telemetry schema 2 in metrics_live.
- Coreutils hostname -s/--short man/options; rebuild kernel bins/man.
- POSIX + P2P dashboard section in docs/README; handbook/DOCUMENTATION/
  release-checklist/OTA/KERNEL_CONTRACT/PEAR-RUN and related reference updates.
- verify-boot-policy-extension-signer-pins: scan kernel init fragments.

Note: vendor drift section removed from kernel/lib/bare/README.md (intentional).

scripts/lib/kernel-init-bundle.mjs

@@ -1,5 +1,6 @@
 /**
- * Single source of truth for the kernel/init.js bundle recipe (lib/boot/*.js + lib/init/init-main.js).
+ * Single source of truth for the kernel/init.js bundle recipe
+ * (lib/boot/*.js + lib/init/fragments/*.js + lib/init/init-main.js).
  * Used by verify-kernel-seeder-parity and verify-init-bundle-recipe.
  */
 import fs from 'node:fs'
@@ -11,6 +12,7 @@ import path from 'node:path'
  */
 export function computeKernelInitJsFromRecipe(canonicalKernelDir) {
   const bootDir = path.join(canonicalKernelDir, 'lib', 'boot')
+  const initFragmentsDir = path.join(canonicalKernelDir, 'lib', 'init', 'fragments')
   const mainPath = path.join(canonicalKernelDir, 'lib', 'init', 'init-main.js')
   if (!fs.existsSync(mainPath)) {
     throw new Error(`kernel-init-bundle: missing ${mainPath}`)
@@ -25,8 +27,25 @@ export function computeKernelInitJsFromRecipe(canonicalKernelDir) {
       parts.push(fs.readFileSync(path.join(bootDir, n), 'utf8').trimEnd())
     }
   }
+  const fragParts = []
+  if (fs.existsSync(initFragmentsDir)) {
+    const fnames = fs
+      .readdirSync(initFragmentsDir)
+      .filter((n) => n.endsWith('.js'))
+      .sort()
+    for (const n of fnames) {
+      fragParts.push(
+        fs.readFileSync(path.join(initFragmentsDir, n), 'utf8').trimEnd()
+      )
+    }
+  }
   const main = fs.readFileSync(mainPath, 'utf8')
-  return (parts.length ? parts.join('\n\n') + '\n\n' : '') + main
+  let out = parts.length ? parts.join('\n\n') + '\n\n' : ''
+  if (fragParts.length) {
+    out += fragParts.join('\n\n') + '\n\n'
+  }
+  out += main
+  return out
 }
 
 /**
@@ -38,7 +57,7 @@ export function assertKernelInitJsMatchesRecipe(canonicalKernelDir) {
   const actual = fs.readFileSync(outPath, 'utf8')
   if (actual !== expected) {
     throw new Error(
-      'kernel/init.js does not match bundle recipe (lib/boot/*.js + lib/init/init-main.js). Run: node scripts/bundle-kernel-init.mjs'
+      'kernel/init.js does not match bundle recipe (lib/boot/*.js + lib/init/fragments/*.js + lib/init/init-main.js). Run: node scripts/bundle-kernel-init.mjs'
     )
   }
 }