feat(boot,vfs,security): expand kernel boot contract, VFS snapshots, and ctx surfaces

- Kernel: strict capability contract merge, junit selftest, startup class, cold boot
  budget warning, boot txn schema v1, rc/kernel.ext resolution traces, richer
  bareOsPublishBootReady (steps/bootSteps, FSM sketch)
- Booter: warm reboot extra cycles, boot provenance on boot.json, step mirroring,
  corestore/swarm suspend-resume hooks, swarm connection manager sketch, event bus
  + optional NDJSON, security_posture proc schema v2, key handle TTL/scopes
- VFS: snapshot path class + BARE_OS_VFS_SNAPSHOTS checkout views, policy metrics,
  batch put + diff helpers, watch consistency hint, quotas vfsQuota fields
- Protocol: BARE_OS_PROTOMUX_CORK_HINT_VERSION via channel exports
- Initd: BARE_INITD_UNIT_STATES; shell: tokenizer module split
- Extensions: capability conflict detector in kernel-extension-resolver
- Docs/scripts: reference index map, observability event bus, dry-run vs rollback
  table, benchmark trend + integration-lab smoke, scripts README
- Tests: /proc listing + pseudo path caps for snapshots and security_posture

docs/reference/README.md

@@ -2,6 +2,18 @@
 
 This directory holds the split **file-by-file inventory** that used to live in the root [`DOCUMENTATION.md`](../../DOCUMENTATION.md) stub. Use it when you need paths, package roles, and environment variables without a narrative walkthrough.
 
+### Documentation map (single index)
+
+| Kind | Where to start |
+| --- | --- |
+| Project overview | [README](../../README.md) |
+| Operator narrative | [Handbook](../../handbook/README.md) |
+| Contributor / `ctx` / Pear | [Developer guide](../../developer-guide/README.md) |
+| Day-to-day use | [Users manual](../../users-manual/README.md) |
+| File-level inventory | This directory (`docs/reference/`) |
+| JSON Schemas | [`docs/schemas/`](../schemas/) |
+| CI / verifiers | [`scripts/README.md`](../../scripts/README.md) |
+
 ---
 
 ## On this page
@@ -29,6 +41,7 @@ This directory holds the split **file-by-file inventory** that used to live in t
 - **VFS path classes (policy sketch)** — [vfs-path-classes.md](vfs-path-classes.md)
 - **Observability contracts** — [observability-contracts.md](observability-contracts.md)
 - **Kernel extensions (short index)** — [kernel-extensions-capability-specs.md](kernel-extensions-capability-specs.md)
+- **Kernel extensions (generated TOC)** — [kernel-extensions-generated-toc.md](kernel-extensions-generated-toc.md)
 - **OTA channel sketch** — [ota-channels.md](ota-channels.md)
 - **POSIX conformance dashboard (sketch)** — [conformance-dashboard.md](conformance-dashboard.md)
 - **Machine-readable data stubs** — [../data/README.md](../data/README.md)