feat(kernel): derivation-tree revocation, region caps

- caps record parent (mint/delegate/ipc), CapRef w/ pid+slot gens
- Revoke = delete subtree, keep self; drop/death re-parents children
- CreateRegion/MapRegion; mapping lives only as long as its cap
- drop Permission::Revoke + object-wide revoke
- mint any cap (badge only ep/ntfn), process caps delegable
- kani: descendants == subtree; model-based fuzz vs spec

crates/kernel/src/syscall/mod.rs

@@ -116,6 +116,13 @@ impl<P: Platform> Kernel<P> {
             Syscall::Kill { process } => self.handle_kill(pid, process),
             Syscall::Revoke { slot } => self.handle_revoke(pid, slot),
             Syscall::DropCap { slot } => self.handle_drop_cap(pid, slot),
+            Syscall::CreateRegion { pages } => {
+                complete(self.create_region_cap(pid, pages).map(SyscallResult::Slot))
+            }
+            Syscall::MapRegion { region, va, perms } => complete(
+                self.map_region_cap(pid, region, va, perms)
+                    .map(|()| SyscallResult::Ok),
+            ),
             Syscall::Delegate {
                 slot,
                 to_endpoint,