feat(protocol)!: kernel capability wire v2 and ctx capability maps

Replace top-level seed/proc bits (bits, bits2, … bits11) with
kernelCapabilityWords (semantic camelCase keys), kernelCapabilityWireVersion,
and helpers in kernel-capability-wire.js. Bump bare-os-protocol to 0.9.0 and
BARE_OS_KERNEL_FEATURE_BITS_DOC to 15.

Booter: emit/consume v2 on bare_os.capabilities, /proc/bare_os_features, debug
proc, offline LKG seedCapabilityInfo; BARE_OS_SEED_CAP_STRICT walks semantic
keys. Guest ctx exposes frozen bareOsAdvertisedKernelCapabilityWords and
bareOsSeedKernelCapabilityWords; remove per-word bareOsAdvertisedKernelCapabilities*
and bareOsSeedCapability* (BARE_OS_CTX_API_VERSION 1.22.0).

Kernel boot policy (stock init.js + seeder copy) reads advertised/seed words
via those maps. Update bare-os-ctx.d.ts, CI verifiers, compatibility matrix,
capability-words docs, ADR 001, and changelogs.

Fix duplicate re-exports of EXTENDED_SEEDING_PLATFORM and RLIMITS_DELEGATES_SHELL
in bare-os-protocol/index.js (Pear/Bare duplicate export error).

scripts/verify-kernel-capabilities-word-7.mjs

@@ -0,0 +1,40 @@
+#!/usr/bin/env node
+/**
+ * CI: feature-roadmap.md must contain 100 numbered rows under "## Wave 7" (word-7 checklist).
+ */
+import fs from 'node:fs'
+import path from 'node:path'
+import process from 'node:process'
+import { fileURLToPath } from 'node:url'
+
+const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..')
+
+function read(rel) {
+  return fs.readFileSync(path.join(root, rel), 'utf8')
+}
+
+function main() {
+  const md = read('docs/reference/feature-roadmap.md')
+  const idx = md.indexOf('## Wave 7')
+  if (idx < 0) {
+    console.error('feature-roadmap.md missing ## Wave 7 section')
+    process.exit(1)
+  }
+  const rest = md.slice(idx + '## Wave 7'.length)
+  const nextH2 = rest.search(/\n## /)
+  const block = nextH2 < 0 ? rest : rest.slice(0, nextH2)
+  let count = 0
+  for (const line of block.split('\n')) {
+    if (/^\| *[0-9]+ *\|/.test(line)) count++
+  }
+  if (count < 100) {
+    console.error(
+      'verify-kernel-capabilities-word-7: expected >=100 table rows in Wave 7, got',
+      count
+    )
+    process.exit(1)
+  }
+  console.log('verify-kernel-capabilities-word-7: OK', count, 'rows')
+}
+
+main()