Implement the 20-track POSIX + P2P roadmap: booter, protocol, coreutils, docs,

and seeder/kernel parity.

Booter / ctx (1.44.0)
- bareOsReadPearRuntimeSnapshotJson; hrpc stock routes documented (kernel.*,
  vfs.readText, bare_os.echo, bare_os.disk_os_hints).
- Peer admission: BARE_OS_DHT_ADDRESS_CLASS_ALLOWLIST + meta.dhtAddressClass;
  shouldAttemptPeer(peerKey, meta).
- Optional BARE_OS_VFS_WARM_CACHE_INVALIDATE_ON_APPEND on system drive cores.
- maybeMergeBareFromDrive: path dedupe + early exit when manifest keys satisfied.
- identity-account: zero UTF-8 passphrase buffer after PBKDF2 (string path).

Shell / utilities
- BARE_OS_SHELL_ERREXIT and set -e / set +e; tests in bare-os-booter/test.js.
- expand: comma-separated POSIX-style tab stops; man page + coreutils tests.

Tooling / docs
- kernel-microbench vfs: warmReplicationPathClassify sketch.
- holepunch-drift-repos suggestedCriticalRepos; sync-holepunch-clones report.
- scripts/README: pretest maintainer runbook; handbook/12 P2P vs POSIX.
- KERNEL_CONTRACT, environment appendix, PLACEHOLDER_BASELINE (multisig gate),
  compatibility matrix, posix artifacts, syscalls.example.json, seeder sync.

Requires: npm run pretest && npm test (already green in session).

docs/reference/architecture-data-flow.md

@@ -24,6 +24,10 @@ sequenceDiagram
 
 After replication, the booter records **`vfs`** → **`ctx`** → **`repl`** → **`initd`** → **`kernel_invoke`** (see [`KERNEL_CONTRACT`](../architecture/KERNEL_CONTRACT.md)) before the stock **`start(ctx)`** loop opens the interactive shell unless **`BARE_OS_SKIP_REPL`** applies.
 
+### Swarm `disk.os` bridge (post-`initd`)
+
+[`createBareOsDiskOsBridge`](../../packages/bare-os-booter/lib/bare-os-disk-os-bridge.js) is assigned to **`disk.os`**. Peer **`searchLocal`** aggregates path substring matches from the **system** Hyperdrive and every **`SwarmDisk.auxiliaryDrives`** entry (read-only mirrors under **`/mirror/aux*`**), dedupes, and caps results. Optional host env **`BARE_OS_DISK_OS_SEARCH_THROTTLE_MS`** (0–500) yields between per-drive scans for large images. Whitelisted RPC **`bare_os.disk_os_hints`** exposes advisory **`mirrorDriveHintV2`** and **`httpDhtProxyHint`** objects when the booter populated them from seed RPCs — operators only; guests do not auto-apply them.
+
 ```mermaid
 flowchart TB
   vfsStep[vfs createVfs]