feat(booter): POSIX/P2P kernel roadmap — sockets, disk.os, VFS, docs

- Bump bareOsCtxApiVersion to 1.46.0 and POSIX profile 1.0.10; sync
  syscalls example, process table, compatibility matrix, CHANGELOGs.
- Socket FD bridge: passive SOCK_DGRAM bind/connect/send path, poll
  readiness; bareOsPosixPoll monotonic timeouts via bare-hrtime.
- disk.os: replication_operator_sketch schema 2; cap-gated
  replication_operator_intent + audit; enrich protomux proc JSON.
- VFS: route /.bare/** to personal drive; optional
  BARE_OS_PERSONAL_VAULT_INDEX_CACHE_MS readdir TTL cache.
- Boot policy: p2pAdmission (peerAllowlistHex, hyperswarmBootstrap) in
  schema + kernel init merge into ctx.env when unset.
- Coreutils/booter getconf: expand _SC_* coverage; shell wait -n under
  BARE_OS_SHELL_POSIX_MODE; seeder multisig verify → security_posture.
- Tests: vfs /.bare routing; test.bare-smoke + test:bare; bench schema 2.
- Docs: syscall-socket-contract, handbook/env/kernel-extensions,
  holepunch drift pretest note, vault threat model multisig section.
- Drop hyperbee from bare-os-booter package.json dependencies (if that
  change is part of this commit).

docs/reference/package-bare-os-booter.md

@@ -63,7 +63,7 @@ See also [Kernel subsystem map](../architecture/kernel-subsystems.md) and [ADR 0
   - **`saveVault()`** — encrypt personal-drive files into `/.bare/vault/` (skips `/.bare`, `bin`, `boot`, history paths).
   - **`registerKernelShutdownHook(fn)`** — register async/sync teardown before **`stopBareInitd`** when the REPL session cleans up.
 - After **`createKernelReplSession`**: wires **`readLine`**, **`console`**, **`execLine`**, **`suspendReplForSubprocess`** / **`resumeReplAfterSubprocess`**, then **`await startBareInitd(ctx)`** (services such as kernel log mirroring).
-- Sets `disk.os` with stub `searchLocal` ([]) and `execRpc` (`''`) **after initd** (reserved for future local OS hooks; peer **search** / **RPC** use **`SwarmDisk`** message **3–6** and **`disk.rpc()`** — see §12.4).
+- Sets **`disk.os`** **after initd** with **`createBareOsDiskOsBridge`** (**`searchLocal`**, whitelisted **`execRpc`** / **`bare_os.*`**, optional **`replication_operator_sketch`** schema **2**, cap-gated **`replication_operator_intent`** when **`BARE_OS_DISK_OS_OPERATOR_INTENT_RPC=1`**) — peers use **`SwarmDisk`** messages **3–6**; see [`bare-os-disk-os-bridge.js`](../../packages/bare-os-booter/lib/bare-os-disk-os-bridge.js) and §12.4.
 - `try { await runKernelFromSource(...) } finally { await session.cleanup() }` — cleanup runs **`bareInitdShutdownActiveUnitsReverse`**, **`runKernelShutdownHooks`**, **`stopBareInitd`**, fish TTY teardown.
 
 **`boot-splash.js`** — TTY splash (disabled when `stdout` is not a TTY or `BARE_OS_NO_SPLASH=1`): initial full-screen clear and hidden cursor, then centered redraws from the top-left without erasing the whole screen each tick (reduces flicker); one full clear again if the terminal is resized. Vertically and horizontally centered “card” (Unicode box frame when wide enough; compact rules on very narrow widths). On very wide terminals the framed card (and progress bar) width is capped so the bar does not span the entire display. Layout scales with `stdout.columns` / `stdout.rows` (sensible fallbacks): more log lines on tall terminals (capped), word-wrapped phase text, ANSI-safe centering. **`createBootSplash(stdout, { bootLimitMs?, tagline?, footerLines? })`** — optional **`tagline`** and dim **`footerLines`**; **`main()`** passes booter and protocol package versions. Braille spinner, elapsed boot timer, bar vs `BARE_OS_BOOT_TIMEOUT_MS` (default 60s), shimmer title. `prepareForKernel()` stops the splash ticker, clears again, and shows the cursor before the fish shell; `fail()` centers a wrapped error message.