feat(kernel): derivation-tree revocation, region caps

- caps record parent (mint/delegate/ipc), CapRef w/ pid+slot gens
- Revoke = delete subtree, keep self; drop/death re-parents children
- CreateRegion/MapRegion; mapping lives only as long as its cap
- drop Permission::Revoke + object-wide revoke
- mint any cap (badge only ep/ntfn), process caps delegable
- kani: descendants == subtree; model-based fuzz vs spec

crates/domain/src/endpoint/mod.rs

@@ -111,13 +111,6 @@ impl EndpointTable {
         self.generations.current(id.raw() as usize)
     }
 
-    /// Invalidates every existing capability to `id`; the endpoint lives on.
-    pub fn revoke(&mut self, id: EndpointId) {
-        if self.get(id).is_some() {
-            self.generations.advance(id.raw() as usize);
-        }
-    }
-
     pub fn ids_owned_by(&self, owner: ProcessId) -> impl Iterator<Item = EndpointId> + '_ {
         self.endpoints
             .iter()

crates/domain/src/endpoint/tests.rs

@@ -102,18 +102,6 @@ fn senders_and_receivers_are_independent() {
     assert_eq!(ep.dequeue_receiver(), Some(thread(2)));
 }
 
-#[test]
-fn revoke_bumps_generation_but_keeps_the_endpoint() {
-    let mut table = EndpointTable::new();
-    let id = table.create(owner()).unwrap();
-    let gen_before = table.generation(id).unwrap();
-    table.revoke(id);
-    let gen_after = table.generation(id).unwrap();
-
-    assert!(!gen_before.is_valid_against(&gen_after));
-    assert!(table.get(id).is_some());
-}
-
 #[test]
 fn reused_slot_gets_a_new_generation() {
     let mut table = EndpointTable::new();