feat(boot,vfs,security): expand kernel boot contract, VFS snapshots, and ctx surfaces

- Kernel: strict capability contract merge, junit selftest, startup class, cold boot
  budget warning, boot txn schema v1, rc/kernel.ext resolution traces, richer
  bareOsPublishBootReady (steps/bootSteps, FSM sketch)
- Booter: warm reboot extra cycles, boot provenance on boot.json, step mirroring,
  corestore/swarm suspend-resume hooks, swarm connection manager sketch, event bus
  + optional NDJSON, security_posture proc schema v2, key handle TTL/scopes
- VFS: snapshot path class + BARE_OS_VFS_SNAPSHOTS checkout views, policy metrics,
  batch put + diff helpers, watch consistency hint, quotas vfsQuota fields
- Protocol: BARE_OS_PROTOMUX_CORK_HINT_VERSION via channel exports
- Initd: BARE_INITD_UNIT_STATES; shell: tokenizer module split
- Extensions: capability conflict detector in kernel-extension-resolver
- Docs/scripts: reference index map, observability event bus, dry-run vs rollback
  table, benchmark trend + integration-lab smoke, scripts README
- Tests: /proc listing + pseudo path caps for snapshots and security_posture

packages/bare-os-seeder/kernel/lib/bare/manifest.json

@@ -1,12 +1,30 @@
 {
   "version": 1,
   "bundles": [
+    {
+      "path": "/lib/bare/bundles/b4a.js",
+      "keys": [
+        "b4a"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/hypercoreIdEncoding.js",
       "keys": [
         "hypercoreIdEncoding"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/safetyCatch.js",
+      "keys": [
+        "safetyCatch"
+      ]
+    },
+    {
+      "path": "/lib/bare/bundles/compactEncoding.js",
+      "keys": [
+        "compactEncoding"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/protomux.js",
       "keys": [
@@ -19,24 +37,6 @@
         "bareUrl"
       ]
     },
-    {
-      "path": "/lib/bare/bundles/safetyCatch.js",
-      "keys": [
-        "safetyCatch"
-      ]
-    },
-    {
-      "path": "/lib/bare/bundles/b4a.js",
-      "keys": [
-        "b4a"
-      ]
-    },
-    {
-      "path": "/lib/bare/bundles/compactEncoding.js",
-      "keys": [
-        "compactEncoding"
-      ]
-    },
     {
       "path": "/lib/bare/bundles/bareEncoding.js",
       "keys": [
@@ -68,15 +68,15 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareReadline.js",
+      "path": "/lib/bare/bundles/bareAnsiEscapes.js",
       "keys": [
-        "bareReadline"
+        "bareAnsiEscapes"
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareAddonResolve.js",
+      "path": "/lib/bare/bundles/bareReadline.js",
       "keys": [
-        "bareAddonResolve"
+        "bareReadline"
       ]
     },
     {
@@ -86,9 +86,9 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareAnsiEscapes.js",
+      "path": "/lib/bare/bundles/bareAddonResolve.js",
       "keys": [
-        "bareAnsiEscapes"
+        "bareAddonResolve"
       ]
     },
     {
@@ -98,9 +98,9 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareAppKit.js",
+      "path": "/lib/bare/bundles/fetch.js",
       "keys": [
-        "bareAppKit"
+        "fetch"
       ]
     },
     {
@@ -110,15 +110,15 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareApk.js",
+      "path": "/lib/bare/bundles/bareAppKit.js",
       "keys": [
-        "bareApk"
+        "bareAppKit"
       ]
     },
     {
-      "path": "/lib/bare/bundles/fetch.js",
+      "path": "/lib/bare/bundles/bareApk.js",
       "keys": [
-        "fetch"
+        "bareApk"
       ]
     },
     {
@@ -170,9 +170,9 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareConsole.js",
+      "path": "/lib/bare/bundles/bareDebugLog.js",
       "keys": [
-        "bareConsole"
+        "bareDebugLog"
       ]
     },
     {
@@ -181,12 +181,6 @@
         "bareBundleId"
       ]
     },
-    {
-      "path": "/lib/bare/bundles/bareDebugLog.js",
-      "keys": [
-        "bareDebugLog"
-      ]
-    },
     {
       "path": "/lib/bare/bundles/bareChannel.js",
       "keys": [
@@ -194,9 +188,9 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareDelta.js",
+      "path": "/lib/bare/bundles/bareConsole.js",
       "keys": [
-        "bareDelta"
+        "bareConsole"
       ]
     },
     {
@@ -206,9 +200,9 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareDns.js",
+      "path": "/lib/bare/bundles/bareDelta.js",
       "keys": [
-        "bareDns"
+        "bareDelta"
       ]
     },
     {
@@ -223,6 +217,12 @@
         "bareEnv"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/bareDns.js",
+      "keys": [
+        "bareDns"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/bareExif.js",
       "keys": [
@@ -235,18 +235,18 @@
         "bareDgram"
       ]
     },
-    {
-      "path": "/lib/bare/bundles/bareFfmpeg.js",
-      "keys": [
-        "bareFfmpeg"
-      ]
-    },
     {
       "path": "/lib/bare/bundles/bareCov.js",
       "keys": [
         "bareCov"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/bareFfmpeg.js",
+      "keys": [
+        "bareFfmpeg"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/bareFfmpegEncodings.js",
       "keys": [
@@ -265,6 +265,12 @@
         "bareGif"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/bareGtk.js",
+      "keys": [
+        "bareGtk"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/bareFileLogger.js",
       "keys": [
@@ -283,12 +289,6 @@
         "bareHeif"
       ]
     },
-    {
-      "path": "/lib/bare/bundles/bareHrtime.js",
-      "keys": [
-        "bareHrtime"
-      ]
-    },
     {
       "path": "/lib/bare/bundles/bareHttpParser.js",
       "keys": [
@@ -296,9 +296,9 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareGtk.js",
+      "path": "/lib/bare/bundles/bareHrtime.js",
       "keys": [
-        "bareGtk"
+        "bareHrtime"
       ]
     },
     {
@@ -319,6 +319,12 @@
         "bareImageResample"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/bareHttp1.js",
+      "keys": [
+        "bareHttp1"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/bareInspect.js",
       "keys": [
@@ -326,9 +332,9 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareHttp1.js",
+      "path": "/lib/bare/bundles/bareJpeg.js",
       "keys": [
-        "bareHttp1"
+        "bareJpeg"
       ]
     },
     {
@@ -343,30 +349,12 @@
         "bareIntl"
       ]
     },
-    {
-      "path": "/lib/bare/bundles/bareJpeg.js",
-      "keys": [
-        "bareJpeg"
-      ]
-    },
     {
       "path": "/lib/bare/bundles/bareIpc.js",
       "keys": [
         "bareIpc"
       ]
     },
-    {
-      "path": "/lib/bare/bundles/bareInspector.js",
-      "keys": [
-        "bareInspector"
-      ]
-    },
-    {
-      "path": "/lib/bare/bundles/bareLogger.js",
-      "keys": [
-        "bareLogger"
-      ]
-    },
     {
       "path": "/lib/bare/bundles/bareLief.js",
       "keys": [
@@ -380,15 +368,15 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareMake.js",
+      "path": "/lib/bare/bundles/bareLogger.js",
       "keys": [
-        "bareMake"
+        "bareLogger"
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareModuleResolve.js",
+      "path": "/lib/bare/bundles/bareInspector.js",
       "keys": [
-        "bareModuleResolve"
+        "bareInspector"
       ]
     },
     {
@@ -397,6 +385,12 @@
         "bareModuleLexer"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/bareMake.js",
+      "keys": [
+        "bareMake"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/bareModule.js",
       "keys": [
@@ -404,15 +398,15 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareModuleTraverse.js",
+      "path": "/lib/bare/bundles/bareModuleResolve.js",
       "keys": [
-        "bareModuleTraverse"
+        "bareModuleResolve"
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareMedia.js",
+      "path": "/lib/bare/bundles/bareNdk.js",
       "keys": [
-        "bareMedia"
+        "bareNdk"
       ]
     },
     {
@@ -422,9 +416,9 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareNdk.js",
+      "path": "/lib/bare/bundles/bareModuleTraverse.js",
       "keys": [
-        "bareNdk"
+        "bareModuleTraverse"
       ]
     },
     {
@@ -439,6 +433,12 @@
         "bareNet"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/bareMedia.js",
+      "keys": [
+        "bareMedia"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/bareOpen.js",
       "keys": [
@@ -451,12 +451,6 @@
         "bareOs"
       ]
     },
-    {
-      "path": "/lib/bare/bundles/barePackDrive.js",
-      "keys": [
-        "barePackDrive"
-      ]
-    },
     {
       "path": "/lib/bare/bundles/barePack.js",
       "keys": [
@@ -464,9 +458,9 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/barePng.js",
+      "path": "/lib/bare/bundles/barePackDrive.js",
       "keys": [
-        "barePng"
+        "barePackDrive"
       ]
     },
     {
@@ -475,6 +469,18 @@
         "barePerformance"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/bareDev.js",
+      "keys": [
+        "bareDev"
+      ]
+    },
+    {
+      "path": "/lib/bare/bundles/barePng.js",
+      "keys": [
+        "barePng"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/barePipe.js",
       "keys": [
@@ -487,12 +493,6 @@
         "barePunycode"
       ]
     },
-    {
-      "path": "/lib/bare/bundles/bareDev.js",
-      "keys": [
-        "bareDev"
-      ]
-    },
     {
       "path": "/lib/bare/bundles/barePrebuild.js",
       "keys": [
@@ -500,9 +500,9 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareQueueMicrotask.js",
+      "path": "/lib/bare/bundles/bareQuerystring.js",
       "keys": [
-        "bareQueueMicrotask"
+        "bareQuerystring"
       ]
     },
     {
@@ -512,9 +512,9 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/barePromClient.js",
+      "path": "/lib/bare/bundles/bareQueueMicrotask.js",
       "keys": [
-        "barePromClient"
+        "bareQueueMicrotask"
       ]
     },
     {
@@ -529,12 +529,6 @@
         "bareRealm"
       ]
     },
-    {
-      "path": "/lib/bare/bundles/bareQuerystring.js",
-      "keys": [
-        "bareQuerystring"
-      ]
-    },
     {
       "path": "/lib/bare/bundles/bareRuntime.js",
       "keys": [
@@ -542,9 +536,9 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareSemver.js",
+      "path": "/lib/bare/bundles/barePromClient.js",
       "keys": [
-        "bareSemver"
+        "barePromClient"
       ]
     },
     {
@@ -553,30 +547,30 @@
         "bareSdl"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/bareSemver.js",
+      "keys": [
+        "bareSemver"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/bareRpc.js",
       "keys": [
         "bareRpc"
       ]
     },
-    {
-      "path": "/lib/bare/bundles/bareSignals.js",
-      "keys": [
-        "bareSignals"
-      ]
-    },
-    {
-      "path": "/lib/bare/bundles/bareSidecar.js",
-      "keys": [
-        "bareSidecar"
-      ]
-    },
     {
       "path": "/lib/bare/bundles/bareRun.js",
       "keys": [
         "bareRun"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/bareSignals.js",
+      "keys": [
+        "bareSignals"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/bareRepl.js",
       "keys": [
@@ -584,9 +578,9 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareStorage.js",
+      "path": "/lib/bare/bundles/bareSidecar.js",
       "keys": [
-        "bareStorage"
+        "bareSidecar"
       ]
     },
     {
@@ -596,9 +590,9 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareStdio.js",
+      "path": "/lib/bare/bundles/bareStorage.js",
       "keys": [
-        "bareStdio"
+        "bareStorage"
       ]
     },
     {
@@ -619,12 +613,24 @@
         "bareStructuredClone"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/bareStdio.js",
+      "keys": [
+        "bareStdio"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/bareSubprocess.js",
       "keys": [
         "bareSubprocess"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/bareSystemLogger.js",
+      "keys": [
+        "bareSystemLogger"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/bareTiff.js",
       "keys": [
@@ -638,9 +644,15 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareSystemLogger.js",
+      "path": "/lib/bare/bundles/bareTimers.js",
       "keys": [
-        "bareSystemLogger"
+        "bareTimers"
+      ]
+    },
+    {
+      "path": "/lib/bare/bundles/bareTpl.js",
+      "keys": [
+        "bareTpl"
       ]
     },
     {
@@ -655,30 +667,12 @@
         "bareTcp"
       ]
     },
-    {
-      "path": "/lib/bare/bundles/bareTpl.js",
-      "keys": [
-        "bareTpl"
-      ]
-    },
     {
       "path": "/lib/bare/bundles/bareType.js",
       "keys": [
         "bareType"
       ]
     },
-    {
-      "path": "/lib/bare/bundles/bareTimers.js",
-      "keys": [
-        "bareTimers"
-      ]
-    },
-    {
-      "path": "/lib/bare/bundles/bareUiKit.js",
-      "keys": [
-        "bareUiKit"
-      ]
-    },
     {
       "path": "/lib/bare/bundles/bareTls.js",
       "keys": [
@@ -686,9 +680,9 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareTty.js",
+      "path": "/lib/bare/bundles/bareUiKit.js",
       "keys": [
-        "bareTty"
+        "bareUiKit"
       ]
     },
     {
@@ -698,15 +692,15 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareV8.js",
+      "path": "/lib/bare/bundles/bareTty.js",
       "keys": [
-        "bareV8"
+        "bareTty"
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareVm.js",
+      "path": "/lib/bare/bundles/bareV8.js",
       "keys": [
-        "bareVm"
+        "bareV8"
       ]
     },
     {
@@ -716,9 +710,9 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareWebKit.js",
+      "path": "/lib/bare/bundles/bareVm.js",
       "keys": [
-        "bareWebKit"
+        "bareVm"
       ]
     },
     {
@@ -728,9 +722,9 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareWebp.js",
+      "path": "/lib/bare/bundles/bareWebKit.js",
       "keys": [
-        "bareWebp"
+        "bareWebKit"
       ]
     },
     {
@@ -740,9 +734,9 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareWhich.js",
+      "path": "/lib/bare/bundles/bareWebp.js",
       "keys": [
-        "bareWhich"
+        "bareWebp"
       ]
     },
     {
@@ -751,6 +745,12 @@
         "bareWebKitGtk"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/bareWhich.js",
+      "keys": [
+        "bareWhich"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/bareV8ToIstanbul.js",
       "keys": [
@@ -770,15 +770,15 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareZlib.js",
+      "path": "/lib/bare/bundles/bareWs.js",
       "keys": [
-        "bareZlib"
+        "bareWs"
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareZmq.js",
+      "path": "/lib/bare/bundles/bareZlib.js",
       "keys": [
-        "bareZmq"
+        "bareZlib"
       ]
     },
     {
@@ -788,9 +788,9 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareWs.js",
+      "path": "/lib/bare/bundles/bareZmq.js",
       "keys": [
-        "bareWs"
+        "bareZmq"
       ]
     }
   ],