feat(kernel): expand stock image, boot policy, and ecosystem integration

- Stock kernel: boot.policy v2 (maxExecLineDepth, denyEnvKeys, requireProcNodes);
  richer BARE_OS_KERNEL_SELFTEST; example policy and timer drop-in samples
- Protocol: feature bits 28–30, seed RPCs (manifest_hints, peer_health, staging_slot)
- Booter: /proc mirrors, provenance, metrics_live, pear IPC registry, initd DAG,
  suspend/resume wiring, exec budget, shell ${var} expansion, delegate limits,
  telemetry v3 / OTel JSONL, ctx API 1.11.0
- Coreutils: /bin/timeout; seeder Pear/Bare: avoid bare process.env (globalThis.process?.env)
- CI: verify-ctx-api-feature-bits; docs: handbook, developer-guide, kernel-extensions,
  capabilities index, environment appendix, READMEs

scripts/verify-ctx-api-feature-bits.mjs

@@ -0,0 +1,71 @@
+#!/usr/bin/env node
+/**
+ * CI: ensure booter wires ctx API semver and protocol stock feature mask.
+ */
+import fs from 'node:fs'
+import path from 'node:path'
+import process from 'node:process'
+import { fileURLToPath } from 'node:url'
+
+const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..')
+
+const ctxApiPath = path.join(
+  root,
+  'packages/bare-os-booter/lib/bare-os-ctx-api.js'
+)
+const indexPath = path.join(root, 'packages/bare-os-booter/index.js')
+const bitsPath = path.join(
+  root,
+  'packages/bare-os-protocol/lib/kernel-feature-bits.js'
+)
+
+function read(p) {
+  return fs.readFileSync(p, 'utf8')
+}
+
+function main() {
+  const ctxSrc = read(ctxApiPath)
+  const verMatch = ctxSrc.match(
+    /export const BARE_OS_CTX_API_VERSION = '([^']+)'/
+  )
+  if (!verMatch) {
+    console.error('Could not parse BARE_OS_CTX_API_VERSION from', ctxApiPath)
+    process.exit(1)
+  }
+
+  const idx = read(indexPath)
+  if (!idx.includes('bareOsCtxApiVersion: BARE_OS_CTX_API_VERSION')) {
+    console.error(
+      'index.js should assign bareOsCtxApiVersion from BARE_OS_CTX_API_VERSION'
+    )
+    process.exit(1)
+  }
+  if (!idx.includes('BARE_OS_KERNEL_FEATURES_STOCK_V1')) {
+    console.error('index.js should reference BARE_OS_KERNEL_FEATURES_STOCK_V1')
+    process.exit(1)
+  }
+
+  const bitsSrc = read(bitsPath)
+  if (!bitsSrc.includes('export const BARE_OS_KERNEL_FEATURES_STOCK_V1')) {
+    console.error('kernel-feature-bits.js missing BARE_OS_KERNEL_FEATURES_STOCK_V1')
+    process.exit(1)
+  }
+  const docMatch = bitsSrc.match(
+    /export const BARE_OS_KERNEL_FEATURE_BITS_DOC = (\d+)/
+  )
+  if (!docMatch) {
+    console.error('Could not parse BARE_OS_KERNEL_FEATURE_BITS_DOC')
+    process.exit(1)
+  }
+
+  console.log(
+    'verify-ctx-api-feature-bits:',
+    'ctx',
+    verMatch[1],
+    '| bits doc',
+    docMatch[1],
+    'OK'
+  )
+}
+
+main()