- Add bits8 / STOCK_V8 / FEATURE8_* and wire strict seed + ctx API bumps

- Protocol 0.4.0: new seed RPCs, channel/replication adjuncts, STOCK_V8 test
- Booter: wave8 /proc surfaces, vfs routes, boot policy env passthrough, limits
- Kernel: boot.policy v8 (feature bits, bare runtime min, deny RPCs, protomux cap)
- Schemas/examples: extensions v5, telemetry/audit bumps; seeder/kernel rsync parity
- Docs: roadmap Wave 8 (100 rows), ADR Word 8, capabilities index, privacy/GDPR, DNSSEC
- CI: verify-kernel-roadmap-wave8, wave3/ctx/compat updates; scripts/README
- Fix /proc flat + nested listing order to match default string sort (vfs + tests)

packages/bare-os-booter/lib/git-cli.js

@@ -200,6 +200,23 @@ export async function runGitCli(ctx, argv) {
     }
 
     if (sub === 'clone') {
+      const gpol = String(
+        vfs.env?.BARE_OS_BOOT_POLICY_GIT_PARTIAL_CLONE || ''
+      )
+        .trim()
+        .toLowerCase()
+      if (gpol === 'deny') {
+        const partial = tail.some((a) =>
+          /^--filter(?:=|$)/.test(String(a))
+        )
+        if (partial) {
+          ctx.console.error(
+            'git: partial clone denied (boot.policy gitPartialClonePolicy=deny)'
+          )
+          ctx.exitCode = 2
+          return
+        }
+      }
       const http = await getHttp(ctx)
       const url = tail[0]
       if (!url) {