feat(booter): POSIX/P2P roadmap — profile 1.0.14, ctx 1.50.0, docs & tests

- Sync declared POSIX profile, compliance matrix, syscalls examples, dashboard
- Extend holepunch clone sync reporting; bump protomux/hyperswarm lock fixture schema
- Optional shell read builtin (BARE_OS_SHELL_READ_*); host env passthrough
- Expand bareOsGetconfSysconf / getconf; pathconf for acct/union/mirror
- Wasm optional bare_os_monotonic_ms; replication live snapshot hints schema
- Socket bridge SO_RCVBUF/SO_SNDBUF; mq priority + FIFO ordering + tests
- Extract cooperative fcntl lock helpers; FIFO waiter drain tests
- Peer admission audit helpers, rate limit + redaction tests; security_posture schema
- CI: verify-ctx requires CHANGELOG row, d.ts version mention, compatibility matrix
- Warm-cache microbench (vfs suite); boot budget / metrics cohesion (prior work)
- Handbook, KERNEL_CONTRACT, kernel-program, env appendix, README, users-manual, schemas

Kernel bundle + seeder rsync + coreutils build verified via npm test.

docs/reference/package-bare-os-booter.md

@@ -6,7 +6,9 @@ Former **DOCUMENTATION.md** §§12.1–12.9 (runtime, VFS, shell, identity). [Re
 
 ### 12.1 [packages/bare-os-booter/package.json](../../packages/bare-os-booter/package.json)
 
-**Resolved hyperstack (hoisted root lockfile, illustrative):** after **`npm install`** at the repo root, **`node_modules/protomux`** and **`node_modules/hyperswarm`** versions are pinned in **`package-lock.json`** and guarded by **`packages/bare-os-booter/test.js`** (**`fixtures/protomux-hyperswarm-lock.json`**). Intentional upgrades require bumping that fixture alongside the lockfile.
+**Resolved hyperstack (hoisted root lockfile, illustrative):** after **`npm install`** at the repo root, **`node_modules/protomux`** and **`node_modules/hyperswarm`** versions are pinned in **`package-lock.json`** and guarded by **`packages/bare-os-booter/test.js`** (**`fixtures/protomux-hyperswarm-lock.json`**, **`schema` 2** metadata row). Intentional upgrades require bumping that fixture alongside the lockfile.
+
+**Hyperbee guest hints:** **`ctx.bareOsHyperbeeGuestHint()`** (when **`BARE_OS_HYPERBEE_GUEST_INDEX`** is set) returns read-only JSON aligned with optional **[hyperbee2](https://github.com/holepunchto/hyperbee2)**-style guest indexes — see [ADR-hyperbee-guest-index.md](../architecture/ADR-hyperbee-guest-index.md); the stock kernel does not import Hyperbee by default.
 
 - `main` — `./index.js`
 - `scripts.start` / `dev` — `bare index.js`