- Add kernel init bundle helper + verify:init-bundle; tighten release-checklist gates

- Implement cooperative F_GETLK/F_SETLK/F_SETLKW; optional BARE_OS_POSIX_SOCKET_FD_BRIDGE
- Add ctx.bareOsGetconfSysconf; extend getconf for _SC_*; awk delete stmt; POSIX heredoc cap
- disk.os: replication_snapshot + replication_operator_sketch; blind-relay swarm schema 2
- Protomux operatorMetrics.backpressureEmitCount; warm-cache invalidate on boot/init puts
- Bump POSIX profile 1.0.6 and syscalls.json schema 6; sync schemas, handbook, env appendix
- Tests + seeder/kernel parity (rsync after coreutils/bare-libs builds)

scripts/verify-init-bundle-recipe.mjs

@@ -0,0 +1,25 @@
+#!/usr/bin/env node
+/**
+ * Fail fast if kernel/init.js was edited without running bundle-kernel-init.mjs.
+ * (Also embedded in verify-kernel-seeder-parity.mjs; this script is for focused checks / hooks.)
+ */
+import fs from 'node:fs'
+import path from 'node:path'
+import process from 'node:process'
+import { fileURLToPath } from 'node:url'
+import { assertKernelInitJsMatchesRecipe } from './lib/kernel-init-bundle.mjs'
+
+const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..')
+const canonical = path.join(root, 'kernel')
+
+try {
+  if (!fs.existsSync(path.join(canonical, 'init.js'))) {
+    console.error('verify-init-bundle-recipe: missing kernel/init.js')
+    process.exit(1)
+  }
+  assertKernelInitJsMatchesRecipe(canonical)
+} catch (e) {
+  console.error(e instanceof Error ? e.message : e)
+  process.exit(1)
+}
+console.log('verify-init-bundle-recipe: kernel/init.js matches bundle recipe.')