feat(boot,vfs,security): expand kernel boot contract, VFS snapshots, and ctx surfaces

- Kernel: strict capability contract merge, junit selftest, startup class, cold boot
  budget warning, boot txn schema v1, rc/kernel.ext resolution traces, richer
  bareOsPublishBootReady (steps/bootSteps, FSM sketch)
- Booter: warm reboot extra cycles, boot provenance on boot.json, step mirroring,
  corestore/swarm suspend-resume hooks, swarm connection manager sketch, event bus
  + optional NDJSON, security_posture proc schema v2, key handle TTL/scopes
- VFS: snapshot path class + BARE_OS_VFS_SNAPSHOTS checkout views, policy metrics,
  batch put + diff helpers, watch consistency hint, quotas vfsQuota fields
- Protocol: BARE_OS_PROTOMUX_CORK_HINT_VERSION via channel exports
- Initd: BARE_INITD_UNIT_STATES; shell: tokenizer module split
- Extensions: capability conflict detector in kernel-extension-resolver
- Docs/scripts: reference index map, observability event bus, dry-run vs rollback
  table, benchmark trend + integration-lab smoke, scripts README
- Tests: /proc listing + pseudo path caps for snapshots and security_posture

scripts/gen-kernel-extensions-index.mjs

@@ -0,0 +1,26 @@
+#!/usr/bin/env node
+/**
+ * Generate a short table-of-contents from docs/reference/kernel-extensions.md (## headings).
+ */
+import fs from 'node:fs'
+import path from 'node:path'
+import { fileURLToPath } from 'node:url'
+
+const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..')
+const src = path.join(root, 'docs/reference/kernel-extensions.md')
+const out = path.join(root, 'docs/reference/kernel-extensions-generated-toc.md')
+
+const text = fs.readFileSync(src, 'utf8')
+const lines = []
+for (const line of text.split(/\r?\n/)) {
+  const m = line.match(/^## (.+)/)
+  if (m) lines.push(`- ${m[1].trim()}`)
+}
+const body = `<!-- Generated by scripts/gen-kernel-extensions-index.mjs — do not edit by hand. -->
+
+# Kernel extensions — generated TOC
+
+${lines.join('\n')}
+`
+fs.writeFileSync(out, body)
+console.log('gen-kernel-extensions-index:', path.relative(root, out), lines.length, 'headings')