Implement the 20-track POSIX + P2P roadmap: booter, protocol, coreutils, docs,

and seeder/kernel parity.

Booter / ctx (1.44.0)
- bareOsReadPearRuntimeSnapshotJson; hrpc stock routes documented (kernel.*,
  vfs.readText, bare_os.echo, bare_os.disk_os_hints).
- Peer admission: BARE_OS_DHT_ADDRESS_CLASS_ALLOWLIST + meta.dhtAddressClass;
  shouldAttemptPeer(peerKey, meta).
- Optional BARE_OS_VFS_WARM_CACHE_INVALIDATE_ON_APPEND on system drive cores.
- maybeMergeBareFromDrive: path dedupe + early exit when manifest keys satisfied.
- identity-account: zero UTF-8 passphrase buffer after PBKDF2 (string path).

Shell / utilities
- BARE_OS_SHELL_ERREXIT and set -e / set +e; tests in bare-os-booter/test.js.
- expand: comma-separated POSIX-style tab stops; man page + coreutils tests.

Tooling / docs
- kernel-microbench vfs: warmReplicationPathClassify sketch.
- holepunch-drift-repos suggestedCriticalRepos; sync-holepunch-clones report.
- scripts/README: pretest maintainer runbook; handbook/12 P2P vs POSIX.
- KERNEL_CONTRACT, environment appendix, PLACEHOLDER_BASELINE (multisig gate),
  compatibility matrix, posix artifacts, syscalls.example.json, seeder sync.

Requires: npm run pretest && npm test (already green in session).

packages/bare-os-booter/lib/bare-os-swarm-peer-policy.js

@@ -150,12 +150,13 @@ export class BareOsSwarmPeerPolicyEngine {
 
   /**
    * @param {string} peerKey
+   * @param {{ dhtAddressClass?: string } | null | undefined} [meta]
    * @returns {boolean} false when peer is in ban window or reconnect budget exhausted
    */
-  shouldAttemptPeer(peerKey) {
+  shouldAttemptPeer(peerKey, meta) {
     const k = this._key(peerKey)
     if (this._env) {
-      const adm = evaluateBareOsPeerAdmission(this._env, k)
+      const adm = evaluateBareOsPeerAdmission(this._env, k, meta)
       if (adm.verdict === 'deny') return false
     }
     const st = this._peers.get(k)