feat(kernel): derivation-tree revocation, region caps

- caps record parent (mint/delegate/ipc), CapRef w/ pid+slot gens
- Revoke = delete subtree, keep self; drop/death re-parents children
- CreateRegion/MapRegion; mapping lives only as long as its cap
- drop Permission::Revoke + object-wide revoke
- mint any cap (badge only ep/ntfn), process caps delegable
- kani: descendants == subtree; model-based fuzz vs spec

crates/adapter-riscv/src/trap/mod.rs

@@ -241,6 +241,19 @@ fn decode_syscall(frame: &TrapFrame) -> Option<domain::syscall::Syscall> {
             stack: StackPointer::from_raw(a(2)),
         },
         SYS_CREATE_ENDPOINT => Syscall::CreateEndpoint,
+        SYS_CREATE_REGION => Syscall::CreateRegion {
+            pages: PageCount::new(u16::try_from(a(0)).ok()?)?,
+        },
+        SYS_MAP_REGION => Syscall::MapRegion {
+            region: slot(0)?,
+            va: VirtualAddress::from_raw(a(1)),
+            perms: match a(2) {
+                PERMS_READ_ONLY => types::mapping::PagePerms::ReadOnly,
+                PERMS_READ_WRITE => types::mapping::PagePerms::ReadWrite,
+                PERMS_READ_EXECUTE => types::mapping::PagePerms::ReadExecute,
+                _ => return None,
+            },
+        },
         SYS_DEBUG_PUTCHAR => Syscall::DebugPutchar { byte: a(0) as u8 },
         SYS_MAP_PAGE => Syscall::MapPage {
             process: slot(0)?,