Move editable kernel bulk from kernel/init-main.js to kernel/lib/init/

(staged as /lib/init/init-main.js); point bundle-kernel-init and verify
scripts at the new path.

Wire curl, wget, openssl, ssh-keygen, and tar through coreutils and
booter host delegates with booter-side CLI helpers; refresh related
bins, bare manifest, shell completion, and man DB (kernel + seeder).

Add booter support modules for ACL evaluation, audit chain, secret
handles, peer admission, replication priority, process table, swarm
lifecycle, boot-graph proc, metrics, monotonic time, protomux alias
registry, and swarm peer policy; extend extension resolver, VFS,
swarm connection managers, IPC, identity-account, and initd.

Harden bare-os-bare-libs build on esbuild failure; add verify scripts
for extension manifest schema and runtime incomplete markers; extend
ctx API typings, gen-ctx-client-stub, and verify-ctx-dts.

Update boot hook fragment, bundled init.js, handbook and reference
docs (incl. kernel security and VFS path classes).

kernel/lib/init/STRUCTURE.md

@@ -1,6 +1,6 @@
 # Stock kernel internal layout (`/boot/init.js`)
 
-The shipped kernel is a **single** Hyperdrive file evaluated with `AsyncFunction` (see `packages/bare-os-booter/lib/kernel-runner.js`). Logical modules map to regions of `kernel/init.js` for maintenance:
+The shipped kernel is a **single** Hyperdrive file evaluated with `AsyncFunction` (see `packages/bare-os-booter/lib/kernel-runner.js`). The editable bulk of that script lives in **`init-main.js`** in this directory (staged on the image as **`/lib/init/init-main.js`**); `scripts/bundle-kernel-init.mjs` concatenates `kernel/lib/boot/*.js` + **`init-main.js`** → repo-root **`kernel/init.js`** (staged as **`/boot/init.js`**). Logical modules map to regions of `kernel/init.js` for maintenance:
 
 | Concern | Responsibility |
 | --- | --- |