- Add first-party vs vendored rules to verify-banned-terminology; naming docs,

alias matrix, verify-naming-alias-matrix in pretest
- Canonical bareOsRegisterBootStepHook / Invoke / EmitBareBootStepHint with
  legacy *Phase* wrappers; typings, runtime caps, docs, CHANGELOG
- VFS: evaluateBareOsVfsPathPolicy; rename hypercore-pack proc locals; add
  /proc/bare_os/security_posture.json
- Stock kernel: invokeCtxBootHooks, boot txn journal transactionState, extension
  cycle extId diagnostics, boot snapshot schema 2 + provenance
- Offline LKG: BARE_OS_OFFLINE_LKG_ACTIVE / REASON env hints
- Protocol: BARE_OS_PROTOMUX_CHANNEL_SCHEMA_VERSION re-exported from channel.js
- Stubs: corestore suspend/resume register, swarm snapshot, extension resolver,
  initd state enum; shell split note; benchmark/SDK script placeholders
- Docs: ota-channels, conformance-dashboard, kernel-extensions specs index,
  data README; handbook/developer-guide/users-manual cross-links
- Sync packages/bare-os-seeder/kernel with kernel/init.js and STRUCTURE.md

scripts/verify-naming-alias-matrix.mjs

@@ -0,0 +1,43 @@
+#!/usr/bin/env node
+/**
+ * CI: naming-alias-matrix.md must list canonical ↔ legacy ctx hooks and policy keys.
+ */
+import fs from 'node:fs'
+import path from 'node:path'
+import process from 'node:process'
+import { fileURLToPath } from 'node:url'
+
+const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..')
+
+const required = [
+  'bareOsRegisterBootStepHook',
+  'bareOsRegisterBootPhaseHook',
+  'bareOsInvokeBootStepHooks',
+  'bareOsInvokeBootPhaseHooks',
+  'bareOsEmitBareBootStepHint',
+  'bareOsEmitBareBootPhaseHint',
+  'skipBootStages',
+  'skipPhases',
+  'denyBootStages',
+  'denyBootPhases',
+  'bootStagesRequireProcIndexMinSchema',
+  'bootPhasesRequireProcIndexMinSchema',
+  'kernel_program.json',
+  'giant_phase_program.json'
+]
+
+function main() {
+  const md = fs.readFileSync(
+    path.join(root, 'docs/reference/naming-alias-matrix.md'),
+    'utf8'
+  )
+  for (const s of required) {
+    if (!md.includes(s)) {
+      console.error('verify-naming-alias-matrix: missing required substring:', s)
+      process.exit(1)
+    }
+  }
+  console.log('verify-naming-alias-matrix: OK')
+}
+
+main()