feat(kernel): Wave 9 mega-phase — bits9, protocol 0.5, boot policy v9, Pear/Bare bridge

- Add ninth capability word (bits9), STOCK_V9, FEATURE9_*; bump feature bits doc to 11
- Extend seed RPCs, channel wiring, replication/staging adjuncts; bare_os_proc_index schema 5
- Wave 9 /proc JSON via bare-os-wave9-proc.js + VFS aliases; ctx API 1.18.0 + d.ts hooks
- Boot policy v9 + kernel/init.js enforcement; extensions registry schema 6; strict bits9 caps
- NDJSON lifecycle 8, OTel 6, audit 6; SOCKS proxy map, worker/WASM/env passthrough
- Coreutils openssl stub (bare-crypto doc); mediaproc:* worker group; http-fetch SOCKS lookup
- CI: verify-kernel-roadmap-wave9.mjs, wave3/ctx/dts/compat updates; pretest chain
- Docs: roadmap Wave 9 table, ADR §12, kernel-extensions/capabilities/matrix/protocol/handbook/
  developer-guide (node-to-bare-modules, privacy), kernel README, scripts README, changelogs
- Sync packages/bare-os-seeder/kernel (init.js, README); refresh booter /proc readdir test list

developer-guide/README.md

@@ -42,6 +42,7 @@ This project is **experimental research software**. APIs described here follow t
 | [11 — Kernel + Pear cookbook](11-kernel-pear-cookbook.md)               | Boot allowlist, timers, socket IPC, `vfs.watch`, HDMS hooks, Git-in-Pear, release metadata |
 | [12 — Bare modules and Pear ecosystem](12-bare-modules-and-pear-ecosystem.md) | `ctx.bare`, manifest, drive bundles, Holepunch `bare-*` mirror vs guaranteed keys |
 | [13 — Privacy, telemetry, and PII](13-privacy-telemetry-pii.md) | Scrub lists for NDJSON / OTel mirrors; non-secret posture |
+| [Node → Bare module map](node-to-bare-modules.md) | Guest-safe replacements for **`node:*`** built-ins (**`bare-crypto`**, **`bare-module`**, …) |
 | [bare-boot vs kernel phases](bare-boot-kernel-phase-alignment.md) | Conceptual map: Holepunch **`bare-boot`** stages vs stock **`kernel/init.js`** |
 
 ---