feat(kernel): derivation-tree revocation, region caps

- caps record parent (mint/delegate/ipc), CapRef w/ pid+slot gens
- Revoke = delete subtree, keep self; drop/death re-parents children
- CreateRegion/MapRegion; mapping lives only as long as its cap
- drop Permission::Revoke + object-wide revoke
- mint any cap (badge only ep/ntfn), process caps delegable
- kani: descendants == subtree; model-based fuzz vs spec

crates/domain/src/memory/mod.rs

@@ -1,4 +1,4 @@
-use crate::generations::SlotGenerations;
+use crate::{capability::CapRef, generations::SlotGenerations};
 use types::{
     address::{PhysicalAddress, VirtualAddress},
     bounded::PageCount,
@@ -35,6 +35,9 @@ pub struct RegionMapping {
     pub process: ProcessId,
     pub va: VirtualAddress,
     pub perms: PagePerms,
+    /// The capability the mapping was made through. Deleting that
+    /// capability removes the mapping; `None` for kernel-made mappings.
+    pub via: Option<CapRef>,
 }
 
 /// Physically contiguous memory that may be mapped into several address
@@ -132,13 +135,6 @@ impl RegionTable {
         self.generations.current(id.raw() as usize)
     }
 
-    /// Invalidates every existing capability to `id`; the region lives on.
-    pub fn revoke(&mut self, id: RegionId) {
-        if self.get(id).is_some() {
-            self.generations.advance(id.raw() as usize);
-        }
-    }
-
     fn free_slot(&self) -> Option<usize> {
         (0..MAX_REGIONS).find(|&i| self.regions[i].is_none() && self.generations.is_usable(i))
     }