feat(booter): POSIX/P2P roadmap — syscalls v4, mirror VFS, seeder snapshot hints

- Bump ctx API to 1.31.0; extend /proc/bare_os/syscalls.json schema 4 (fdModel, signalModel)
- Add /mirror/aux* routing for auxiliary Hyperdrives; optional BLAKE2b-keyed /bin cache (BARE_OS_VFS_BIN_CACHE_BLAKE2B)
- Wire seeder snapshotHintsJson from BARE_OS_SEED_* env; add seeder unit tests
- Shell: trap -p; docs for jobs/bg/trap; sync schemas, examples, compatibility matrix, handbook ch.9
- Coreutils: Issue 7 man option rows for cp/mv/ln/find/grep/sed/awk/tar/test/true; xcu-issue7-sweep tests
- Docs: env appendix, vault-threat-model, node-vs-bare-host-matrix, test:bare, CHANGELOG 1.31.0

docs/reference/node-vs-bare-host-matrix.md

@@ -0,0 +1,17 @@
+# Node vs Bare host matrix
+
+This repository mixes **Node** (CI and some package scripts) and **Bare** / **Pear** (stock booter and seeder entrypoints). Use this table when choosing where a test or tool runs.
+
+| Surface | Typical host | Notes |
+|--------|----------------|-------|
+| `packages/bare-os-booter/test.js` | **Node** + `bare-node-test-shim.cjs` | Exercises the booter with Brittle; uses Node `fs` / `path` in the harness only. |
+| `packages/bare-os-booter/test.identity.js` | **Bare** (`brittle-bare`) | Identity paths prefer Bare APIs. |
+| `packages/bare-os-protocol/test.js` | **Bare** (`brittle-bare`); optional `test:node` | Protocol encodings are runtime-agnostic. |
+| `packages/bare-os-coreutils/test/*.mjs` | **Node** | Utilities are loaded via `AsyncFunction`; stdin/fs helpers use Node in tests. |
+| `packages/bare-os-booter` `start` / `dev` | **Bare** (`bare index.js`) | Production-shaped guest path; Pear uses the same tree with staged `node_modules`. |
+| Guest **`ctx`** / **`/bin`** / kernel **`init.js`** | **Bare** (or Pear) | Must not rely on `node:*` built-ins; use **`bare-*`** shims per project rules. |
+| Repo `pretest` verify scripts | **Node** | Static analysis, schema checks, bundle policy. |
+
+Root **`npm run test:bare`** runs a small Bare-first slice (protocol + coreutils Node tests are still Node; see script in root `package.json`).
+
+For Holepunch alignment, compare versions against your local mirror under `holepunchto_repos` (e.g. `bare-subprocess`, `bare-hrtime`, `pear-runtime`).