Trusted JavaScript modules loaded only via /etc/bare-os/kernel.ext.d/*.json (see stock kernel header).
Each JSON file lists: { "scripts": ["/lib/bare-os/extensions/example.js"] }.
Paths must stay under /lib/bare-os/extensions/.