Implement the 20-task Bare OS POSIX + P2P roadmap: holepunch lockfile drift

reporting and audit:holepunch-clones docs; placeholder baseline automation;
maintainer kernel-image sync script; protomux schema coupling in protocol
tests; disk.os RPC hints (replication_operator_sketch, hyperblobs/blind v3);
union/mirror VFS + warm-cache selective eviction tests; extension resolver
coverage; curl/wget fall through PATH when BARE_OS_DELEGATE_ALLOW excludes
delegates (kernel-runner) with handbook/ctx docs; socket contract / Wasm /
boot budget strict path / hrpc allowlist tests; subprocess bridge meta;
shell until gate + tar stat metadata; POSIX profile triplet pretest verifier;
regenerate kernel bundle, seeder parity, and audit artifacts as needed.

Covers KERNEL_CONTRACT, POSIX_DECLARED_PROFILE, handbook, developer-guide,
scripts/README, and related reference docs.

scripts/README.md

@@ -252,10 +252,28 @@ Scans vendored **`kernel/lib/bare/bundles/*.js`** for **`TODO` / `FIXME` / `XXX`
 
 ## `sync-holepunch-clones.mjs`
 
-**Usage:** `node scripts/sync-holepunch-clones.mjs` (also **`npm run audit:holepunch-clones`** from the repo root)
+**Usage:** `node scripts/sync-holepunch-clones.mjs` — chained by **`npm run audit:holepunch-clones`** with **`report-holepunch-lockfile-drift.mjs`** (repo root).
 
 Writes **[`docs/audit/holepunch-clone-sync-report.json`](../docs/audit/holepunch-clone-sync-report.json)** for every distinct **`package`** name in **`packages/bare-os-booter/lib/bare-module-manifest.json`** (also honors legacy **`name`** / **`packageName`** if present). Scoped npm names (**`@scope/pkg`**) are mapped to the **`pkg`** directory expected under **`holepunchto_repos`**. Each row records **`cloneExists`**, **`gitHead`**, **`originMainHead`** (run **`git fetch origin main`** in clones so **`origin/main`** is meaningful), and **`packageJsonVersion`**. The same run appends one NDJSON line per manifest row to **[`docs/audit/holepunch-clone-sync-summary.ndjson`](../docs/audit/holepunch-clone-sync-summary.ndjson)** (machine-readable delta feed; commit or regenerate at release). Set **`BARE_OS_HOLEPUNCH_CLONES_ROOT`** when your checkout is not **`$HOME/dev/pearcli/holepunch-repos/holepunchto_repos`**. Operator-maintained; not in default CI.
 
+## `report-holepunch-lockfile-drift.mjs`
+
+**Usage:** `npm run audit:holepunch-clones` (includes this step) or `node scripts/report-holepunch-lockfile-drift.mjs`
+
+Compares hoisted **`package-lock.json`** versions (**`node_modules/<pkg>`**) against **`lockfilePackages`** in **[`docs/audit/holepunch-drift-repos.json`](../docs/audit/holepunch-drift-repos.json)** and local clone **`package.json`** versions. Writes **[`docs/audit/holepunch-lockfile-drift.json`](../docs/audit/holepunch-lockfile-drift.json)** and **`holepunch-lockfile-drift-summary.ndjson`**. Informational only (not a failing CI gate).
+
+## `audit-placeholder-baseline.mjs`
+
+**Usage:** `npm run audit:placeholder-baseline`
+
+Emits **[`docs/audit/placeholder-baseline-scan.json`](../docs/audit/placeholder-baseline-scan.json)** — TODO/stub-phrase sweep over first-party kernel, booter, protocol, and coreutils **`src`** trees (excludes vendored bundles).
+
+## `verify-posix-profile-triplet.mjs`
+
+**Usage:** root **`pretest`**
+
+Fails when **`BARE_OS_POSIX_PROFILE_VERSION`** / **`BARE_OS_POSIX_PROFILE_ID`** diverge between **`bare-os-posix-profile.js`**, **[`POSIX_DECLARED_PROFILE.md`](../docs/architecture/POSIX_DECLARED_PROFILE.md)**, and **`posix-compliance-matrix.json`**, or when the matrix **`note`** omits the profile version string.
+
 ## `verify-holepunch-clone-drift.mjs`
 
 **Usage:** `node scripts/verify-holepunch-clone-drift.mjs` (root **`pretest`**)
@@ -351,7 +369,7 @@ Root **`npm run pretest`** is the canonical doc/code gate. Run it before pushing
 11. **Bundle health / markers / throws** — Upstream bundle hygiene gates.
 12. **Kernel program doc / proc schema / roadmap table verifiers**.
 13. **`scripts/verify-pear-no-static-node-import.mjs`**.
-14. **`scripts/gen-posix-dashboard.mjs`** + **`verify-posix-dashboard.mjs`** + **`verify-posix-compliance-matrix.mjs`**.
+14. **`scripts/gen-posix-dashboard.mjs`** + **`verify-posix-dashboard.mjs`** + **`verify-posix-profile-triplet.mjs`** + **`verify-posix-compliance-matrix.mjs`**.
 15. **`scripts/verify-holepunch-clone-drift.mjs`** — No-op when **`holepunch-drift-repos.json`** **`repos[]`** is empty; optional release gate when populated.
 16. **`npm run smoke:bare-manifest`** — Manifest import smoke.