Move editable kernel bulk from kernel/init-main.js to kernel/lib/init/

(staged as /lib/init/init-main.js); point bundle-kernel-init and verify
scripts at the new path.

Wire curl, wget, openssl, ssh-keygen, and tar through coreutils and
booter host delegates with booter-side CLI helpers; refresh related
bins, bare manifest, shell completion, and man DB (kernel + seeder).

Add booter support modules for ACL evaluation, audit chain, secret
handles, peer admission, replication priority, process table, swarm
lifecycle, boot-graph proc, metrics, monotonic time, protomux alias
registry, and swarm peer policy; extend extension resolver, VFS,
swarm connection managers, IPC, identity-account, and initd.

Harden bare-os-bare-libs build on esbuild failure; add verify scripts
for extension manifest schema and runtime incomplete markers; extend
ctx API typings, gen-ctx-client-stub, and verify-ctx-dts.

Update boot hook fragment, bundled init.js, handbook and reference
docs (incl. kernel security and VFS path classes).

kernel/lib/boot/01-invoke-ctx-hooks.js

@@ -1,6 +1,9 @@
-/** Boot transaction journal row state (resume / audit). */
+/** Boot transaction journal row state (resume / audit / rollback FSM). */
 const BARE_OS_BOOT_TXN_STATE = Object.freeze({
-  STAGE_COMMITTED: 'stage_committed'
+  STAGE_STARTED: 'stage_started',
+  STAGE_COMMITTED: 'stage_committed',
+  STAGE_ROLLBACK: 'stage_rollback',
+  STAGE_SKIPPED: 'stage_skipped'
 })
 
 /**