feat(booter): POSIX/P2P roadmap — profile 1.0.14, ctx 1.50.0, docs & tests

- Sync declared POSIX profile, compliance matrix, syscalls examples, dashboard
- Extend holepunch clone sync reporting; bump protomux/hyperswarm lock fixture schema
- Optional shell read builtin (BARE_OS_SHELL_READ_*); host env passthrough
- Expand bareOsGetconfSysconf / getconf; pathconf for acct/union/mirror
- Wasm optional bare_os_monotonic_ms; replication live snapshot hints schema
- Socket bridge SO_RCVBUF/SO_SNDBUF; mq priority + FIFO ordering + tests
- Extract cooperative fcntl lock helpers; FIFO waiter drain tests
- Peer admission audit helpers, rate limit + redaction tests; security_posture schema
- CI: verify-ctx requires CHANGELOG row, d.ts version mention, compatibility matrix
- Warm-cache microbench (vfs suite); boot budget / metrics cohesion (prior work)
- Handbook, KERNEL_CONTRACT, kernel-program, env appendix, README, users-manual, schemas

Kernel bundle + seeder rsync + coreutils build verified via npm test.

kernel/lib/init/init-main.js

@@ -3372,6 +3372,12 @@ async function maybeWriteBootPerfJson(ctx, bootT0, stageLog) {
         stdlibWall > stdlibBudget
           ? `bare stdlib resolution ${stdlibWall}ms exceeded BARE_OS_BOOT_BUDGET_MS_BARE_STDLIB ${stdlibBudget}ms`
           : null,
+      bootBudgetStrict:
+        ctx.env?.BARE_OS_BOOT_BUDGET_STRICT === '1' ||
+        ctx.env?.BARE_OS_BOOT_BUDGET_STRICT === 'true',
+      bootPolicyStrict:
+        ctx.env?.BARE_OS_BOOT_POLICY_STRICT === '1' ||
+        ctx.env?.BARE_OS_BOOT_POLICY_STRICT === 'true',
       stageCount: stageLog.length,
       stages,
       completedAtMs: Date.now()