- Add first-party vs vendored rules to verify-banned-terminology; naming docs,

alias matrix, verify-naming-alias-matrix in pretest
- Canonical bareOsRegisterBootStepHook / Invoke / EmitBareBootStepHint with
  legacy *Phase* wrappers; typings, runtime caps, docs, CHANGELOG
- VFS: evaluateBareOsVfsPathPolicy; rename hypercore-pack proc locals; add
  /proc/bare_os/security_posture.json
- Stock kernel: invokeCtxBootHooks, boot txn journal transactionState, extension
  cycle extId diagnostics, boot snapshot schema 2 + provenance
- Offline LKG: BARE_OS_OFFLINE_LKG_ACTIVE / REASON env hints
- Protocol: BARE_OS_PROTOMUX_CHANNEL_SCHEMA_VERSION re-exported from channel.js
- Stubs: corestore suspend/resume register, swarm snapshot, extension resolver,
  initd state enum; shell split note; benchmark/SDK script placeholders
- Docs: ota-channels, conformance-dashboard, kernel-extensions specs index,
  data README; handbook/developer-guide/users-manual cross-links
- Sync packages/bare-os-seeder/kernel with kernel/init.js and STRUCTURE.md

scripts/README.md

@@ -33,7 +33,13 @@ Exits **0** only when **`kernel/`** and **`packages/bare-os-seeder/kernel/`** co
 
 **Usage:** `node scripts/verify-banned-terminology.mjs`
 
-Fails when banned governance tokens (**`Wave N`**, **`wave N`**, **`tranche`**, **`mega-phase`**, **`multi-stage` / `multi stage`**) appear in tracked **`md` / `js` / `mjs` / `json`** files (excluding `node_modules`, `share/man/man.json`, and this script). Root **`pretest`**.
+Fails when banned governance tokens (**`Wave N`**, **`wave N`**, **`tranche`**, **`mega-phase`**, **`multi-stage` / `multi stage`**) appear in tracked **`md` / `js` / `mjs` / `json`** files (excluding `node_modules`, **`kernel/lib/bare/`** vendored trees, `share/man/man.json`, and this script). Root **`pretest`**.
+
+## `verify-naming-alias-matrix.mjs`
+
+**Usage:** `node scripts/verify-naming-alias-matrix.mjs`
+
+Ensures [docs/reference/naming-alias-matrix.md](../docs/reference/naming-alias-matrix.md) lists canonical **`ctx`** boot-hook names and boot-policy key aliases. Root **`pretest`**.
 
 ## `verify-ctx-api-feature-bits.mjs`