- Add first-party vs vendored rules to verify-banned-terminology; naming docs,

alias matrix, verify-naming-alias-matrix in pretest
- Canonical bareOsRegisterBootStepHook / Invoke / EmitBareBootStepHint with
  legacy *Phase* wrappers; typings, runtime caps, docs, CHANGELOG
- VFS: evaluateBareOsVfsPathPolicy; rename hypercore-pack proc locals; add
  /proc/bare_os/security_posture.json
- Stock kernel: invokeCtxBootHooks, boot txn journal transactionState, extension
  cycle extId diagnostics, boot snapshot schema 2 + provenance
- Offline LKG: BARE_OS_OFFLINE_LKG_ACTIVE / REASON env hints
- Protocol: BARE_OS_PROTOMUX_CHANNEL_SCHEMA_VERSION re-exported from channel.js
- Stubs: corestore suspend/resume register, swarm snapshot, extension resolver,
  initd state enum; shell split note; benchmark/SDK script placeholders
- Docs: ota-channels, conformance-dashboard, kernel-extensions specs index,
  data README; handbook/developer-guide/users-manual cross-links
- Sync packages/bare-os-seeder/kernel with kernel/init.js and STRUCTURE.md

kernel/lib/init/STRUCTURE.md

@@ -0,0 +1,13 @@
+# Stock kernel internal layout (`/boot/init.js`)
+
+The shipped kernel is a **single** Hyperdrive file evaluated with `AsyncFunction` (see `packages/bare-os-booter/lib/kernel-runner.js`). Logical modules map to regions of `kernel/init.js` for maintenance:
+
+| Concern | Responsibility |
+| --- | --- |
+| Boot policy & env gates | `applyBootPolicyFile`, skip sets, ABI checks |
+| RC runners | `runRcLines`, `kernel.d`, `kernel.ext.d` |
+| Extensions | `runKernelExtDropins`, topological ordering |
+| Selftest | `kernel.d` / `selftest.d` harness |
+| Interactive loop | readline / REPL after boot stages |
+
+Future work may **concatenate** split sources into one deliverable; until then, keep this map updated when moving large blocks.