feat(kernel): Wave 9 mega-phase — bits9, protocol 0.5, boot policy v9, Pear/Bare bridge

- Add ninth capability word (bits9), STOCK_V9, FEATURE9_*; bump feature bits doc to 11
- Extend seed RPCs, channel wiring, replication/staging adjuncts; bare_os_proc_index schema 5
- Wave 9 /proc JSON via bare-os-wave9-proc.js + VFS aliases; ctx API 1.18.0 + d.ts hooks
- Boot policy v9 + kernel/init.js enforcement; extensions registry schema 6; strict bits9 caps
- NDJSON lifecycle 8, OTel 6, audit 6; SOCKS proxy map, worker/WASM/env passthrough
- Coreutils openssl stub (bare-crypto doc); mediaproc:* worker group; http-fetch SOCKS lookup
- CI: verify-kernel-roadmap-wave9.mjs, wave3/ctx/dts/compat updates; pretest chain
- Docs: roadmap Wave 9 table, ADR §12, kernel-extensions/capabilities/matrix/protocol/handbook/
  developer-guide (node-to-bare-modules, privacy), kernel README, scripts README, changelogs
- Sync packages/bare-os-seeder/kernel (init.js, README); refresh booter /proc readdir test list

developer-guide/node-to-bare-modules.md

@@ -0,0 +1,19 @@
+# Node built-ins → Bare / Pear modules (guest-safe)
+
+Bare OS **guest** code (kernel `/boot/init.js`, `/bin` utilities running in the Pear/Bare host) must **not** rely on Node’s **`node:*`** built-in specifiers. Use Holepunch **`bare-*`** packages (local clones under [holepunchto](https://github.com/holepunchto)) instead.
+
+| Node import (avoid in guest) | Prefer |
+| --- | --- |
+| `node:crypto` | [`bare-crypto`](https://github.com/holepunchto/bare-crypto) — host sets **`BARE_OS_BARE_CRYPTO_VERSION`** for boot policy **`requireBareCryptoMin`**. |
+| `node:module` / `createRequire` | [`bare-module`](https://github.com/holepunchto/bare-module), [`bare-module-resolve`](https://github.com/holepunchto/bare-module-resolve) — boot policy may list **`denyBareModuleSpecifierPatterns`**. |
+| `node:fs` | [`bare-fs`](https://github.com/holepunchto/bare-fs) — guest uses **`ctx.vfs`** for the image. |
+| `node:path` | [`bare-path`](https://github.com/holepunchto/bare-path) |
+| `node:url` | [`bare-url`](https://github.com/holepunchto/bare-url) |
+| `node:net` / `node:tls` | [`bare-net`](https://github.com/holepunchto/bare-net), [`bare-tls`](https://github.com/holepunchto/bare-tls), [`bare-tcp`](https://github.com/holepunchto/bare-tcp) |
+| `node:http` / `node:https` | [`bare-http1`](https://github.com/holepunchto/bare-http1), [`bare-https`](https://github.com/holepunchto/bare-https); **`ctx`** may expose wrapped **`fetch`**. |
+| `node:worker_threads` | [`bare-worker`](https://github.com/holepunchto/bare-worker), [`bare-thread`](https://github.com/holepunchto/bare-thread) |
+| `node:diagnostics_channel` | [`bare-diagnostics-channel`](https://github.com/holepunchto/bare-diagnostics-channel) |
+
+Stock **`/bin/openssl`** is a **stub** that points integrators at **`bare-crypto`** (see [`packages/bare-os-coreutils/src/openssl.js`](../../packages/bare-os-coreutils/src/openssl.js)).
+
+See also [kernel-extensions.md](../docs/reference/kernel-extensions.md), [handbook ch.11](../handbook/11-kernel-roadmap-and-research.md), and CI **`verify-pear-no-static-node-import.mjs`**.