feat(booter): disk.os bridge, systemctl ctx API, delegates, and docs

- Add createBareOsDiskOsBridge for Hyperdrive searchLocal + whitelisted
  bare_os.* execRpc; wire disk.os after initd
- Expose ctx.bareOsRunSystemctlCli; route /bin/systemctl and journalctl
  through it (sync seeder kernel/bin)
- Implement ssh-keygen passphrase envelope (bareOsKeySchema 2, PBKDF2 +
  ChaCha20-Poly1305); add warc and archive delegates
- Extend basenc (--base32/--base64); improve hostid/users session UX
- Introduce bare-os-boot-phases, bare-os-errors; CI boot-step alignment
- Bump BARE_OS_CTX_API_VERSION to 1.28.0; update ctx d.ts and verifiers
- Add KERNEL_CONTRACT, OTA_AND_BUNDLES, PLACEHOLDER_BASELINE; handbook
  disk.os + security hooks; reference docs and CHANGELOG

packages/bare-os-seeder/kernel/lib/bare/manifest.json

@@ -2,9 +2,9 @@
   "version": 1,
   "bundles": [
     {
-      "path": "/lib/bare/bundles/safetyCatch.js",
+      "path": "/lib/bare/bundles/hypercoreIdEncoding.js",
       "keys": [
-        "safetyCatch"
+        "hypercoreIdEncoding"
       ]
     },
     {
@@ -14,9 +14,9 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/hypercoreIdEncoding.js",
+      "path": "/lib/bare/bundles/safetyCatch.js",
       "keys": [
-        "hypercoreIdEncoding"
+        "safetyCatch"
       ]
     },
     {
@@ -25,6 +25,12 @@
         "compactEncoding"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/protomux.js",
+      "keys": [
+        "protomux"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/bareUrl.js",
       "keys": [
@@ -32,9 +38,9 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/protomux.js",
+      "path": "/lib/bare/bundles/bareEvents.js",
       "keys": [
-        "protomux"
+        "bareEvents"
       ]
     },
     {
@@ -49,24 +55,12 @@
         "barePath"
       ]
     },
-    {
-      "path": "/lib/bare/bundles/bareEvents.js",
-      "keys": [
-        "bareEvents"
-      ]
-    },
     {
       "path": "/lib/bare/bundles/bareAbort.js",
       "keys": [
         "bareAbort"
       ]
     },
-    {
-      "path": "/lib/bare/bundles/bareAbortController.js",
-      "keys": [
-        "bareAbortController"
-      ]
-    },
     {
       "path": "/lib/bare/bundles/bareAnsiEscapes.js",
       "keys": [
@@ -74,9 +68,9 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareReadline.js",
+      "path": "/lib/bare/bundles/bareAbortController.js",
       "keys": [
-        "bareReadline"
+        "bareAbortController"
       ]
     },
     {
@@ -92,9 +86,9 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareApk.js",
+      "path": "/lib/bare/bundles/bareReadline.js",
       "keys": [
-        "bareApk"
+        "bareReadline"
       ]
     },
     {
@@ -104,9 +98,9 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/fetch.js",
+      "path": "/lib/bare/bundles/bareAppKit.js",
       "keys": [
-        "fetch"
+        "bareAppKit"
       ]
     },
     {
@@ -122,9 +116,15 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareAppKit.js",
+      "path": "/lib/bare/bundles/bareApk.js",
       "keys": [
-        "bareAppKit"
+        "bareApk"
+      ]
+    },
+    {
+      "path": "/lib/bare/bundles/fetch.js",
+      "keys": [
+        "fetch"
       ]
     },
     {
@@ -140,9 +140,9 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareBluetoothApple.js",
+      "path": "/lib/bare/bundles/bareBundle.js",
       "keys": [
-        "bareBluetoothApple"
+        "bareBundle"
       ]
     },
     {
@@ -152,9 +152,9 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareBundle.js",
+      "path": "/lib/bare/bundles/bareBluetoothApple.js",
       "keys": [
-        "bareBundle"
+        "bareBluetoothApple"
       ]
     },
     {
@@ -169,12 +169,6 @@
         "bareBoot"
       ]
     },
-    {
-      "path": "/lib/bare/bundles/bareDebugLog.js",
-      "keys": [
-        "bareDebugLog"
-      ]
-    },
     {
       "path": "/lib/bare/bundles/bareConsole.js",
       "keys": [
@@ -199,6 +193,12 @@
         "bareDelta"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/bareDebugLog.js",
+      "keys": [
+        "bareDebugLog"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/bareDaemon.js",
       "keys": [
@@ -241,12 +241,6 @@
         "bareDgram"
       ]
     },
-    {
-      "path": "/lib/bare/bundles/bareFfmpegEncodings.js",
-      "keys": [
-        "bareFfmpegEncodings"
-      ]
-    },
     {
       "path": "/lib/bare/bundles/bareFfmpeg.js",
       "keys": [
@@ -254,15 +248,9 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareGif.js",
+      "path": "/lib/bare/bundles/bareFfmpegEncodings.js",
       "keys": [
-        "bareGif"
-      ]
-    },
-    {
-      "path": "/lib/bare/bundles/bareFormat.js",
-      "keys": [
-        "bareFormat"
+        "bareFfmpegEncodings"
       ]
     },
     {
@@ -271,6 +259,12 @@
         "bareFormData"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/bareFormat.js",
+      "keys": [
+        "bareFormat"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/bareFileLogger.js",
       "keys": [
@@ -278,21 +272,9 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareGtk.js",
+      "path": "/lib/bare/bundles/bareGif.js",
       "keys": [
-        "bareGtk"
-      ]
-    },
-    {
-      "path": "/lib/bare/bundles/bareFs.js",
-      "keys": [
-        "bareFs"
-      ]
-    },
-    {
-      "path": "/lib/bare/bundles/bareHeif.js",
-      "keys": [
-        "bareHeif"
+        "bareGif"
       ]
     },
     {
@@ -301,12 +283,30 @@
         "bareHrtime"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/bareHeif.js",
+      "keys": [
+        "bareHeif"
+      ]
+    },
+    {
+      "path": "/lib/bare/bundles/bareGtk.js",
+      "keys": [
+        "bareGtk"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/bareHttpParser.js",
       "keys": [
         "bareHttpParser"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/bareFs.js",
+      "keys": [
+        "bareFs"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/bareIco.js",
       "keys": [
@@ -320,15 +320,9 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareInspect.js",
+      "path": "/lib/bare/bundles/bareHttps.js",
       "keys": [
-        "bareInspect"
-      ]
-    },
-    {
-      "path": "/lib/bare/bundles/bareIntl.js",
-      "keys": [
-        "bareIntl"
+        "bareHttps"
       ]
     },
     {
@@ -337,6 +331,12 @@
         "bareHttp1"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/bareInspect.js",
+      "keys": [
+        "bareInspect"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/bareJpeg.js",
       "keys": [
@@ -344,15 +344,9 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareHttps.js",
+      "path": "/lib/bare/bundles/bareIntl.js",
       "keys": [
-        "bareHttps"
-      ]
-    },
-    {
-      "path": "/lib/bare/bundles/bareInspector.js",
-      "keys": [
-        "bareInspector"
+        "bareIntl"
       ]
     },
     {
@@ -361,18 +355,24 @@
         "bareIpc"
       ]
     },
-    {
-      "path": "/lib/bare/bundles/bareLogger.js",
-      "keys": [
-        "bareLogger"
-      ]
-    },
     {
       "path": "/lib/bare/bundles/bareLief.js",
       "keys": [
         "bareLief"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/bareInspector.js",
+      "keys": [
+        "bareInspector"
+      ]
+    },
+    {
+      "path": "/lib/bare/bundles/bareLogger.js",
+      "keys": [
+        "bareLogger"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/bareLink.js",
       "keys": [
@@ -385,18 +385,18 @@
         "bareMake"
       ]
     },
-    {
-      "path": "/lib/bare/bundles/bareModuleLexer.js",
-      "keys": [
-        "bareModuleLexer"
-      ]
-    },
     {
       "path": "/lib/bare/bundles/bareModuleResolve.js",
       "keys": [
         "bareModuleResolve"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/bareModuleLexer.js",
+      "keys": [
+        "bareModuleLexer"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/bareModule.js",
       "keys": [
@@ -451,12 +451,6 @@
         "bareMedia"
       ]
     },
-    {
-      "path": "/lib/bare/bundles/barePack.js",
-      "keys": [
-        "barePack"
-      ]
-    },
     {
       "path": "/lib/bare/bundles/barePerformance.js",
       "keys": [
@@ -470,9 +464,9 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/barePipe.js",
+      "path": "/lib/bare/bundles/barePack.js",
       "keys": [
-        "barePipe"
+        "barePack"
       ]
     },
     {
@@ -482,15 +476,15 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareNodeRuntime.js",
+      "path": "/lib/bare/bundles/barePipe.js",
       "keys": [
-        "bareNodeRuntime"
+        "barePipe"
       ]
     },
     {
-      "path": "/lib/bare/bundles/barePrebuild.js",
+      "path": "/lib/bare/bundles/bareNodeRuntime.js",
       "keys": [
-        "barePrebuild"
+        "bareNodeRuntime"
       ]
     },
     {
@@ -499,18 +493,24 @@
         "barePunycode"
       ]
     },
-    {
-      "path": "/lib/bare/bundles/bareDev.js",
-      "keys": [
-        "bareDev"
-      ]
-    },
     {
       "path": "/lib/bare/bundles/bareQuerystring.js",
       "keys": [
         "bareQuerystring"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/bareQueueMicrotask.js",
+      "keys": [
+        "bareQueueMicrotask"
+      ]
+    },
+    {
+      "path": "/lib/bare/bundles/barePrebuild.js",
+      "keys": [
+        "barePrebuild"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/bareRealm.js",
       "keys": [
@@ -518,9 +518,9 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareQueueMicrotask.js",
+      "path": "/lib/bare/bundles/bareDev.js",
       "keys": [
-        "bareQueueMicrotask"
+        "bareDev"
       ]
     },
     {
@@ -553,12 +553,6 @@
         "bareSemver"
       ]
     },
-    {
-      "path": "/lib/bare/bundles/bareRpc.js",
-      "keys": [
-        "bareRpc"
-      ]
-    },
     {
       "path": "/lib/bare/bundles/bareRepl.js",
       "keys": [
@@ -566,9 +560,9 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareRun.js",
+      "path": "/lib/bare/bundles/bareRpc.js",
       "keys": [
-        "bareRun"
+        "bareRpc"
       ]
     },
     {
@@ -583,12 +577,24 @@
         "bareSidecar"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/bareRun.js",
+      "keys": [
+        "bareRun"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/bareStringDecoder.js",
       "keys": [
         "bareStringDecoder"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/bareStdio.js",
+      "keys": [
+        "bareStdio"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/bareStorage.js",
       "keys": [
@@ -602,9 +608,9 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareStdio.js",
+      "path": "/lib/bare/bundles/bareStructuredClone.js",
       "keys": [
-        "bareStdio"
+        "bareStructuredClone"
       ]
     },
     {
@@ -613,36 +619,12 @@
         "bareSvg"
       ]
     },
-    {
-      "path": "/lib/bare/bundles/bareStructuredClone.js",
-      "keys": [
-        "bareStructuredClone"
-      ]
-    },
-    {
-      "path": "/lib/bare/bundles/bareSystemLogger.js",
-      "keys": [
-        "bareSystemLogger"
-      ]
-    },
     {
       "path": "/lib/bare/bundles/bareSubprocess.js",
       "keys": [
         "bareSubprocess"
       ]
     },
-    {
-      "path": "/lib/bare/bundles/bareTcp.js",
-      "keys": [
-        "bareTcp"
-      ]
-    },
-    {
-      "path": "/lib/bare/bundles/bareTap.js",
-      "keys": [
-        "bareTap"
-      ]
-    },
     {
       "path": "/lib/bare/bundles/bareTiff.js",
       "keys": [
@@ -650,9 +632,15 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareThread.js",
+      "path": "/lib/bare/bundles/bareSystemLogger.js",
       "keys": [
-        "bareThread"
+        "bareSystemLogger"
+      ]
+    },
+    {
+      "path": "/lib/bare/bundles/bareTap.js",
+      "keys": [
+        "bareTap"
       ]
     },
     {
@@ -662,9 +650,15 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareType.js",
+      "path": "/lib/bare/bundles/bareTcp.js",
       "keys": [
-        "bareType"
+        "bareTcp"
+      ]
+    },
+    {
+      "path": "/lib/bare/bundles/bareThread.js",
+      "keys": [
+        "bareThread"
       ]
     },
     {
@@ -674,9 +668,9 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareUiKit.js",
+      "path": "/lib/bare/bundles/bareType.js",
       "keys": [
-        "bareUiKit"
+        "bareType"
       ]
     },
     {
@@ -685,6 +679,12 @@
         "bareTls"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/bareUiKit.js",
+      "keys": [
+        "bareUiKit"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/bareTty.js",
       "keys": [
@@ -697,12 +697,6 @@
         "bareUnpack"
       ]
     },
-    {
-      "path": "/lib/bare/bundles/bareVm.js",
-      "keys": [
-        "bareVm"
-      ]
-    },
     {
       "path": "/lib/bare/bundles/bareV8.js",
       "keys": [
@@ -715,6 +709,18 @@
         "bareWalkHandles"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/bareVm.js",
+      "keys": [
+        "bareVm"
+      ]
+    },
+    {
+      "path": "/lib/bare/bundles/bareWebKit.js",
+      "keys": [
+        "bareWebKit"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/bareUnionBundle.js",
       "keys": [
@@ -727,30 +733,12 @@
         "bareWebp"
       ]
     },
-    {
-      "path": "/lib/bare/bundles/bareWebKit.js",
-      "keys": [
-        "bareWebKit"
-      ]
-    },
-    {
-      "path": "/lib/bare/bundles/bareWebKitGtk.js",
-      "keys": [
-        "bareWebKitGtk"
-      ]
-    },
     {
       "path": "/lib/bare/bundles/bareUtils.js",
       "keys": [
         "bareUtils"
       ]
     },
-    {
-      "path": "/lib/bare/bundles/bareV8ToIstanbul.js",
-      "keys": [
-        "bareV8ToIstanbul"
-      ]
-    },
     {
       "path": "/lib/bare/bundles/bareWhich.js",
       "keys": [
@@ -758,9 +746,9 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareXdiff.js",
+      "path": "/lib/bare/bundles/bareWebKitGtk.js",
       "keys": [
-        "bareXdiff"
+        "bareWebKitGtk"
       ]
     },
     {
@@ -770,15 +758,27 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareZlib.js",
+      "path": "/lib/bare/bundles/bareV8ToIstanbul.js",
       "keys": [
-        "bareZlib"
+        "bareV8ToIstanbul"
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareWs.js",
+      "path": "/lib/bare/bundles/bareXdiff.js",
       "keys": [
-        "bareWs"
+        "bareXdiff"
+      ]
+    },
+    {
+      "path": "/lib/bare/bundles/bareZmq.js",
+      "keys": [
+        "bareZmq"
+      ]
+    },
+    {
+      "path": "/lib/bare/bundles/bareZlib.js",
+      "keys": [
+        "bareZlib"
       ]
     },
     {
@@ -788,9 +788,9 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareZmq.js",
+      "path": "/lib/bare/bundles/bareWs.js",
       "keys": [
-        "bareZmq"
+        "bareWs"
       ]
     }
   ],