Move editable kernel bulk from kernel/init-main.js to kernel/lib/init/

(staged as /lib/init/init-main.js); point bundle-kernel-init and verify
scripts at the new path.

Wire curl, wget, openssl, ssh-keygen, and tar through coreutils and
booter host delegates with booter-side CLI helpers; refresh related
bins, bare manifest, shell completion, and man DB (kernel + seeder).

Add booter support modules for ACL evaluation, audit chain, secret
handles, peer admission, replication priority, process table, swarm
lifecycle, boot-graph proc, metrics, monotonic time, protomux alias
registry, and swarm peer policy; extend extension resolver, VFS,
swarm connection managers, IPC, identity-account, and initd.

Harden bare-os-bare-libs build on esbuild failure; add verify scripts
for extension manifest schema and runtime incomplete markers; extend
ctx API typings, gen-ctx-client-stub, and verify-ctx-dts.

Update boot hook fragment, bundled init.js, handbook and reference
docs (incl. kernel security and VFS path classes).

docs/reference/README.md

@@ -39,6 +39,7 @@ This directory holds the split **file-by-file inventory** that used to live in t
 - **Legacy ↔ canonical names** — [Naming alias matrix](naming-alias-matrix.md)
 - **Kernel program status tables** — [Feature roadmap status](feature-roadmap.md)
 - **VFS path classes (policy sketch)** — [vfs-path-classes.md](vfs-path-classes.md)
+- **Kernel security subsystems** — [kernel-security-subsystems.md](kernel-security-subsystems.md)
 - **Observability contracts** — [observability-contracts.md](observability-contracts.md)
 - **Kernel extensions (short index)** — [kernel-extensions-capability-specs.md](kernel-extensions-capability-specs.md)
 - **Kernel extensions (generated TOC)** — [kernel-extensions-generated-toc.md](kernel-extensions-generated-toc.md)