- Add first-party vs vendored rules to verify-banned-terminology; naming docs,

alias matrix, verify-naming-alias-matrix in pretest
- Canonical bareOsRegisterBootStepHook / Invoke / EmitBareBootStepHint with
  legacy *Phase* wrappers; typings, runtime caps, docs, CHANGELOG
- VFS: evaluateBareOsVfsPathPolicy; rename hypercore-pack proc locals; add
  /proc/bare_os/security_posture.json
- Stock kernel: invokeCtxBootHooks, boot txn journal transactionState, extension
  cycle extId diagnostics, boot snapshot schema 2 + provenance
- Offline LKG: BARE_OS_OFFLINE_LKG_ACTIVE / REASON env hints
- Protocol: BARE_OS_PROTOMUX_CHANNEL_SCHEMA_VERSION re-exported from channel.js
- Stubs: corestore suspend/resume register, swarm snapshot, extension resolver,
  initd state enum; shell split note; benchmark/SDK script placeholders
- Docs: ota-channels, conformance-dashboard, kernel-extensions specs index,
  data README; handbook/developer-guide/users-manual cross-links
- Sync packages/bare-os-seeder/kernel with kernel/init.js and STRUCTURE.md

docs/reference/naming-alias-matrix.md

@@ -0,0 +1,26 @@
+# Naming alias matrix (legacy ↔ canonical)
+
+Machine-checked by `scripts/verify-naming-alias-matrix.mjs` (see root `pretest`). Use **canonical** identifiers in new first-party code; keep **legacy** fields for wire and policy compatibility.
+
+## ctx boot hooks
+
+- **Canonical:** `bareOsRegisterBootStepHook`, `bareOsInvokeBootStepHooks`, `bareOsEmitBareBootStepHint`
+- **Legacy:** `bareOsRegisterBootPhaseHook`, `bareOsInvokeBootPhaseHooks`, `bareOsEmitBareBootPhaseHint`
+
+## Boot policy file keys
+
+- **Canonical:** `skipBootStages`, `denyBootStages`, `bootStagesRequireProcIndexMinSchema`, `bootStagesRequireLifecycleMinSchema`
+- **Legacy:** `skipPhases`, `denyBootPhases`, `bootPhasesRequireProcIndexMinSchema`, `bootPhasesRequireLifecycleMinSchema`
+
+## Boot ready snapshot keys (subsystems.kernel)
+
+- **Canonical:** `stages`, `bootStages`
+- **Legacy mirrors:** `phases`, `bootPhases` (same payloads)
+
+## `/proc` stable names
+
+- **`/proc/bare_os/kernel_program.json`** is canonical; **`giant_phase_program.json`** remains a documented legacy alias filename on some images.
+
+## Terminology policy
+
+- First-party vs vendored scope: [developer-guide/naming-conventions.md](../../developer-guide/naming-conventions.md).