feat(kernel): derivation-tree revocation, region caps

- caps record parent (mint/delegate/ipc), CapRef w/ pid+slot gens
- Revoke = delete subtree, keep self; drop/death re-parents children
- CreateRegion/MapRegion; mapping lives only as long as its cap
- drop Permission::Revoke + object-wide revoke
- mint any cap (badge only ep/ntfn), process caps delegable
- kani: descendants == subtree; model-based fuzz vs spec

crates/kernel/src/syscall/lifecycle.rs

@@ -65,9 +65,12 @@ impl<P: Platform> Kernel<P> {
         match self.grant_cap(
             caller_pid,
             domain::resource::Resource::Process(new_pid),
+            // The creator has full authority over what it creates,
+            // including handing that authority on.
             types::permission::PermissionSet::empty()
                 .with(types::permission::Permission::Execute)
-                .with(types::permission::Permission::Read),
+                .with(types::permission::Permission::Read)
+                .with(types::permission::Permission::Delegate),
         ) {
             Ok(slot) => SyscallOutcome::Complete(SyscallResult::Slot(slot)),
             Err(e) => {