feat(booter): POSIX/P2P roadmap — syscalls v4, mirror VFS, seeder snapshot hints

- Bump ctx API to 1.31.0; extend /proc/bare_os/syscalls.json schema 4 (fdModel, signalModel)
- Add /mirror/aux* routing for auxiliary Hyperdrives; optional BLAKE2b-keyed /bin cache (BARE_OS_VFS_BIN_CACHE_BLAKE2B)
- Wire seeder snapshotHintsJson from BARE_OS_SEED_* env; add seeder unit tests
- Shell: trap -p; docs for jobs/bg/trap; sync schemas, examples, compatibility matrix, handbook ch.9
- Coreutils: Issue 7 man option rows for cp/mv/ln/find/grep/sed/awk/tar/test/true; xcu-issue7-sweep tests
- Docs: env appendix, vault-threat-model, node-vs-bare-host-matrix, test:bare, CHANGELOG 1.31.0

packages/bare-os-seeder/test/build-seeder-snapshot-hints-json.test.mjs

@@ -0,0 +1,29 @@
+/**
+ * @import { test } from 'node:test'
+ */
+import assert from 'node:assert'
+import test from 'node:test'
+import { buildSeederSnapshotHintsJson } from '../lib/build-seeder-snapshot-hints-json.js'
+
+test('empty env yields empty snapshotHintsJson', () => {
+  assert.strictEqual(buildSeederSnapshotHintsJson({}), '')
+})
+
+test('BARE_OS_SEED_CORESTORE_SNAPSHOT_TAG becomes hints payload', () => {
+  const j = buildSeederSnapshotHintsJson({
+    BARE_OS_SEED_CORESTORE_SNAPSHOT_TAG: 'release-42'
+  })
+  const o = JSON.parse(j)
+  assert.strictEqual(o.schema, 1)
+  assert.strictEqual(o.corestoreSnapshotTag, 'release-42')
+  assert.strictEqual(o.source, 'BARE_OS_SEED_CORESTORE_SNAPSHOT_TAG')
+})
+
+test('BARE_OS_SEED_SNAPSHOT_HINTS_JSON wins over tag', () => {
+  const want = '{"schema":9,"slots":["a"]}'
+  const j = buildSeederSnapshotHintsJson({
+    BARE_OS_SEED_SNAPSHOT_HINTS_JSON: want,
+    BARE_OS_SEED_CORESTORE_SNAPSHOT_TAG: 'ignored'
+  })
+  assert.strictEqual(j, want)
+})