feat(boot,vfs,security): expand kernel boot contract, VFS snapshots, and ctx surfaces

- Kernel: strict capability contract merge, junit selftest, startup class, cold boot
  budget warning, boot txn schema v1, rc/kernel.ext resolution traces, richer
  bareOsPublishBootReady (steps/bootSteps, FSM sketch)
- Booter: warm reboot extra cycles, boot provenance on boot.json, step mirroring,
  corestore/swarm suspend-resume hooks, swarm connection manager sketch, event bus
  + optional NDJSON, security_posture proc schema v2, key handle TTL/scopes
- VFS: snapshot path class + BARE_OS_VFS_SNAPSHOTS checkout views, policy metrics,
  batch put + diff helpers, watch consistency hint, quotas vfsQuota fields
- Protocol: BARE_OS_PROTOMUX_CORK_HINT_VERSION via channel exports
- Initd: BARE_INITD_UNIT_STATES; shell: tokenizer module split
- Extensions: capability conflict detector in kernel-extension-resolver
- Docs/scripts: reference index map, observability event bus, dry-run vs rollback
  table, benchmark trend + integration-lab smoke, scripts README
- Tests: /proc listing + pseudo path caps for snapshots and security_posture

developer-guide/adr/000-template.md

@@ -0,0 +1,25 @@
+# ADR 000: Title (template)
+
+- **Status:** proposed | accepted | superseded
+- **Date:** YYYY-MM-DD
+- **Deciders:** (names or roles)
+
+## Context
+
+What problem or contract tension triggered this decision?
+
+## Decision
+
+What we chose (one or two crisp sentences).
+
+## Consequences
+
+Positive, negative, and migration notes. Link superseding ADRs when status changes.
+
+## Doc parity checklist
+
+- [ ] README / DOCUMENTATION stubs
+- [ ] handbook / developer-guide / users-manual
+- [ ] docs/reference + docs/schemas
+- [ ] packages CHANGELOGs and `bareOsCtxApiVersion` / wire version if applicable
+- [ ] `packages/bare-os-seeder/kernel/` when `kernel/` changes

developer-guide/adr/README.md

@@ -0,0 +1,7 @@
+# Architecture decision records (ADRs)
+
+Use [000-template.md](000-template.md) for new decisions. Number sequentially (`001-…`, `002-…`).
+
+ADRs capture **contract and behavior** choices that are expensive to reverse: protocol fields, capability semantics, boot policy keys, and deprecation windows.
+
+Related: [kernel program](../kernel-program.md), [naming migrations](../naming-migrations.md), [compatibility matrix](../../docs/reference/compatibility-matrix.md).