- Add kernel init bundle helper + verify:init-bundle; tighten release-checklist gates

- Implement cooperative F_GETLK/F_SETLK/F_SETLKW; optional BARE_OS_POSIX_SOCKET_FD_BRIDGE
- Add ctx.bareOsGetconfSysconf; extend getconf for _SC_*; awk delete stmt; POSIX heredoc cap
- disk.os: replication_snapshot + replication_operator_sketch; blind-relay swarm schema 2
- Protomux operatorMetrics.backpressureEmitCount; warm-cache invalidate on boot/init puts
- Bump POSIX profile 1.0.6 and syscalls.json schema 6; sync schemas, handbook, env appendix
- Tests + seeder/kernel parity (rsync after coreutils/bare-libs builds)

kernel/etc/bare-os/boot.policy.example.json

@@ -47,5 +47,10 @@
   "denyVfsPrefixes": [],
   "denyExecLineBuiltins": [],
   "allowedCtxMethods": [],
-  "maxInitdRestartsPerUnit": 8
+  "maxInitdRestartsPerUnit": 8,
+  "posixCapabilityHints": [
+    "cooperative_fcntl_locks",
+    "dynamic_sysconf",
+    "socket_fd_bridge_opt_in"
+  ]
 }