feat(boot,vfs,security): expand kernel boot contract, VFS snapshots, and ctx surfaces

- Kernel: strict capability contract merge, junit selftest, startup class, cold boot
  budget warning, boot txn schema v1, rc/kernel.ext resolution traces, richer
  bareOsPublishBootReady (steps/bootSteps, FSM sketch)
- Booter: warm reboot extra cycles, boot provenance on boot.json, step mirroring,
  corestore/swarm suspend-resume hooks, swarm connection manager sketch, event bus
  + optional NDJSON, security_posture proc schema v2, key handle TTL/scopes
- VFS: snapshot path class + BARE_OS_VFS_SNAPSHOTS checkout views, policy metrics,
  batch put + diff helpers, watch consistency hint, quotas vfsQuota fields
- Protocol: BARE_OS_PROTOMUX_CORK_HINT_VERSION via channel exports
- Initd: BARE_INITD_UNIT_STATES; shell: tokenizer module split
- Extensions: capability conflict detector in kernel-extension-resolver
- Docs/scripts: reference index map, observability event bus, dry-run vs rollback
  table, benchmark trend + integration-lab smoke, scripts README
- Tests: /proc listing + pseudo path caps for snapshots and security_posture

scripts/README.md

@@ -35,6 +35,42 @@ Exits **0** only when **`kernel/`** and **`packages/bare-os-seeder/kernel/`** co
 
 Fails when banned governance tokens (**`Wave N`**, **`wave N`**, **`tranche`**, **`mega-phase`**, **`multi-stage` / `multi stage`**) appear in tracked **`md` / `js` / `mjs` / `json`** files (excluding `node_modules`, **`kernel/lib/bare/`** vendored trees, `share/man/man.json`, and this script). Root **`pretest`**.
 
+## `bundle-kernel-init.mjs`
+
+**Usage:** `node scripts/bundle-kernel-init.mjs` (also **`npm run bundle:kernel`**)
+
+Concatenates sorted `kernel/lib/boot/*.js` + `kernel/init-main.js` → **`kernel/init.js`**. Run after editing boot fragments; root **`pretest`** invokes it automatically.
+
+## `verify-feature-roadmap-canonical.mjs`
+
+**Usage:** `node scripts/verify-feature-roadmap-canonical.mjs`
+
+Ensures [docs/data/feature-roadmap-canonical.json](../docs/data/feature-roadmap-canonical.json) aligns with the batch B table in **`feature-roadmap.md`**. Root **`pretest`**.
+
+## `verify-no-new-giant-phase-identifiers.mjs`
+
+**Usage:** `node scripts/verify-no-new-giant-phase-identifiers.mjs`
+
+Blocks new `giant_phase` / `giantPhase` identifiers outside an explicit allowlist (legacy proc compatibility only). Root **`pretest`**.
+
+## `gen-kernel-extensions-index.mjs`
+
+**Usage:** `node scripts/gen-kernel-extensions-index.mjs`
+
+Regenerates [docs/reference/kernel-extensions-generated-toc.md](../docs/reference/kernel-extensions-generated-toc.md). Root **`pretest`**.
+
+## `integration-lab-smoke.mjs`
+
+**Usage:** `node scripts/integration-lab-smoke.mjs`
+
+Placeholder for local mirror + synthetic peer checks; extend with Holepunch fixtures (see developer guide).
+
+## `benchmark-boot-sketch.mjs`
+
+**Usage:** `node scripts/benchmark-boot-sketch.mjs`
+
+Appends one NDJSON trend row (`schema: 1`) to **`BARE_OS_BENCHMARK_TREND_NDJSON`** or **`$TMPDIR/bare-os-benchmark-trend.ndjson`**.
+
 ## `verify-naming-alias-matrix.mjs`
 
 **Usage:** `node scripts/verify-naming-alias-matrix.mjs`