Move editable kernel bulk from kernel/init-main.js to kernel/lib/init/

(staged as /lib/init/init-main.js); point bundle-kernel-init and verify
scripts at the new path.

Wire curl, wget, openssl, ssh-keygen, and tar through coreutils and
booter host delegates with booter-side CLI helpers; refresh related
bins, bare manifest, shell completion, and man DB (kernel + seeder).

Add booter support modules for ACL evaluation, audit chain, secret
handles, peer admission, replication priority, process table, swarm
lifecycle, boot-graph proc, metrics, monotonic time, protomux alias
registry, and swarm peer policy; extend extension resolver, VFS,
swarm connection managers, IPC, identity-account, and initd.

Harden bare-os-bare-libs build on esbuild failure; add verify scripts
for extension manifest schema and runtime incomplete markers; extend
ctx API typings, gen-ctx-client-stub, and verify-ctx-dts.

Update boot hook fragment, bundled init.js, handbook and reference
docs (incl. kernel security and VFS path classes).

kernel/bin/openssl

@@ -88,26 +88,24 @@ function bareOsEmitRaw(ctx, chunk) {
 }
 
 /**
- * Minimal placeholder: OpenSSL CLI is not bundled. Documents use of bare-crypto on Pear/Bare
- * hosts instead of Node `node:crypto` (unavailable in guest bare runtime).
+ * OpenSSL CLI compatibility via booter `openssl-cli.js` (bare-crypto).
  */
 async function run(ctx, argv) {
+  if (typeof ctx.bareOsRunOpensslCli === 'function') {
+    await ctx.bareOsRunOpensslCli(argv)
+    return
+  }
   for (let i = 1; i < argv.length; i++) {
     if (argv[i] === '-h' || argv[i] === '--help') {
       ctx.console.log(
-        'usage: openssl [help]\n' +
-          'Bare OS stub: no OpenSSL binary. Use the host `bare-crypto` module from Pear apps;\n' +
-          'do not rely on Node built-ins such as node:crypto in kernel or /bin utilities.'
+        'usage: openssl version | rand -hex N | dgst -sha256 FILE\n' +
+          'Requires ctx.bareOsRunOpensslCli from the stock booter.'
       )
       return
     }
-    if (argv[i].startsWith('-')) {
-      ctx.console.error('openssl: unsupported option ' + argv[i])
-      ctx.exitCode = 1
-      return
-    }
   }
-  ctx.console.log(
-    'openssl: stub — use bare-crypto (see handbook ch.9 and developer-guide Node→Bare map).'
+  ctx.console.error(
+    'openssl: ctx.bareOsRunOpensslCli missing — upgrade booter / ctx API'
   )
+  ctx.exitCode = 1
 }