feat(kernel): giant-phase boot hooks, proc snapshot, and kernel UX tools

- Add BARE_OS_BOOT_SAFE_MODE, BOOT_TRANSACTION_JOURNAL, BOOT_CHECKPOINT in
  stock kernel; kernel.ext.d requires/after/before ordering; boot-ready
  subsystems.kernel.giantPhase adjunct
- Expose /proc/bare_os/giant_phase_program.json via bare-os-giant-phase;
  wire VFS, baretop snapshot, and ctx batch read
- Add /bin/kernel-doctor and /bin/kernel-explain; verify-giant-phase-doc in
  pretest; giant-phase-benchmark-harness stub
- Bump bareOsCtxApiVersion to 1.23.0; sync seeder kernel/init.js and runtime
  caps; extend booter tests for proc listing and safe mode

Docs: giant-phase-kernel-program.md, feature-roadmap, kernel-extensions,
compatibility-matrix, environment appendix, handbook 06/11, developer
guide, users-manual 07, scripts README; booter CHANGELOG

kernel/bin/kernel-explain

@@ -0,0 +1,135 @@
+/* BARE_OS_BIN_API 1.0.0 — bump when staged /bin script semantics change (see developer guide). */
+/** Shared helpers for drive-resident /bin scripts (prepended before each command). */
+function bareStdin(ctx) {
+  return typeof ctx.shellStdin === 'string' ? ctx.shellStdin : ''
+}
+
+/** @param {number} mode @param {'file' | 'directory' | 'symlink'} type */
+function bareFormatModeString(mode, type) {
+  const typeChar = type === 'directory' ? 'd' : type === 'symlink' ? 'l' : '-'
+  const perm = mode & 0o777
+  const r = (bit) => (perm & bit ? 'r' : '-')
+  const w = (bit) => (perm & bit ? 'w' : '-')
+  const x = (bit) => (perm & bit ? 'x' : '-')
+  return (
+    typeChar +
+    r(0o400) +
+    w(0o200) +
+    x(0o100) +
+    r(0o040) +
+    w(0o020) +
+    x(0o010) +
+    r(0o004) +
+    w(0o002) +
+    x(0o001)
+  )
+}
+
+/** @param {number} mtimeMs @param {number} [nowMs] */
+function bareFormatLsMtime(mtimeMs, nowMs) {
+  const now = nowMs != null ? nowMs : Date.now()
+  const d = new Date(mtimeMs)
+  const months = [
+    'Jan',
+    'Feb',
+    'Mar',
+    'Apr',
+    'May',
+    'Jun',
+    'Jul',
+    'Aug',
+    'Sep',
+    'Oct',
+    'Nov',
+    'Dec'
+  ]
+  const mon = months[d.getMonth()]
+  const day = String(d.getDate()).padStart(2, ' ')
+  const sixMo = 180 * 24 * 3600 * 1000
+  if (Math.abs(now - mtimeMs) > sixMo) {
+    const yr = String(d.getFullYear()).padStart(4, ' ')
+    return mon + ' ' + day + '  ' + yr
+  }
+  const hh = String(d.getHours()).padStart(2, '0')
+  const mm = String(d.getMinutes()).padStart(2, '0')
+  return mon + ' ' + day + ' ' + hh + ':' + mm
+}
+
+/** @param {number} size */
+function barePosixBlocks(size) {
+  return Math.ceil(Number(size) / 512) || 0
+}
+
+/**
+ * Raw stdout for NUL/binary when **`process.stdout.write`** is missing.
+ * If **`ctx.bareOsBinWrite(Uint8Array|string)`** is set (tests / host), use it.
+ * @param {Record<string, unknown>} ctx
+ * @param {string | Uint8Array} chunk
+ * @returns {boolean}
+ */
+function bareOsEmitRaw(ctx, chunk) {
+  if (typeof ctx.bareOsBinWrite === 'function') {
+    const b4 = ctx.b4a
+    const u8 =
+      typeof chunk === 'string'
+        ? b4 && typeof b4.from === 'function'
+          ? b4.from(chunk)
+          : new TextEncoder().encode(chunk)
+        : chunk
+    ctx.bareOsBinWrite(u8 instanceof Uint8Array ? u8 : new Uint8Array(u8))
+    return true
+  }
+  const w = globalThis.process?.stdout?.write
+  if (typeof w === 'function') {
+    w.call(globalThis.process.stdout, chunk)
+    return true
+  }
+  return false
+}
+
+/** Map common failure tokens to documentation anchors (offline-friendly). */
+var KERNEL_EXPLAIN_MAP = {
+  boot_policy: 'docs/reference/kernel-extensions.md — BARE_OS_BOOT_POLICY',
+  safe_mode: 'BARE_OS_BOOT_SAFE_MODE — skips rc.d, kernel.ext.d, onboot (developer-guide/giant-phase-kernel-program.md)',
+  boot_journal:
+    'BARE_OS_BOOT_TRANSACTION_JOURNAL — /run/bare-os/boot-transaction.ndjson',
+  boot_checkpoint: 'BARE_OS_BOOT_CHECKPOINT — /run/bare-os/boot-checkpoint.json',
+  kernel_ext:
+    'kernel.ext.d — dependsOn, requires, after, before (stock kernel/init.js header)',
+  giant_phase:
+    '/proc/bare_os/giant_phase_program.json — giant-phase program snapshot',
+  bare_module:
+    'Use bare-module / bare-node mapping (Holepunch); never node:module in guest',
+  bare_crypto:
+    'Use bare-crypto / bare-node crypto shim; never node:crypto in guest',
+  compat: 'docs/reference/compatibility-matrix.md',
+  roadmap: 'docs/reference/feature-roadmap.md'
+}
+
+async function run(ctx, argv) {
+  const key = String(argv[1] || '')
+    .trim()
+    .toLowerCase()
+    .replace(/^bare_os_/, '')
+    .replace(/-/g, '_')
+  if (!key || argv[1] === '--help' || argv[1] === '-h') {
+    ctx.console.log(
+      'Usage: kernel-explain <topic>\nTopics: ' +
+        Object.keys(KERNEL_EXPLAIN_MAP).sort().join(', ')
+    )
+    return
+  }
+  const hit = KERNEL_EXPLAIN_MAP[key]
+  if (hit) {
+    ctx.console.log(hit)
+    return
+  }
+  for (const [k, v] of Object.entries(KERNEL_EXPLAIN_MAP)) {
+    if (k.includes(key) || key.includes(k)) {
+      ctx.console.log(k + ': ' + v)
+      return
+    }
+  }
+  ctx.console.error('kernel-explain: unknown topic: ' + argv[1])
+  ctx.exitCode = 1
+}