feat(kernel): derivation-tree revocation, region caps

- caps record parent (mint/delegate/ipc), CapRef w/ pid+slot gens
- Revoke = delete subtree, keep self; drop/death re-parents children
- CreateRegion/MapRegion; mapping lives only as long as its cap
- drop Permission::Revoke + object-wide revoke
- mint any cap (badge only ep/ntfn), process caps delegable
- kani: descendants == subtree; model-based fuzz vs spec

crates/kernel/src/tests/helpers.rs

@@ -128,6 +128,33 @@ impl Kernel<MockPlatform> {
         self.destroy_notifications_owned_by(owner);
     }
 
+    /// The process a Process cap in `pid`'s table names, if it is one.
+    pub fn process_cap_target_for_test(&self, pid: ProcessId, slot: CapSlot) -> Option<ProcessId> {
+        match self
+            .processes
+            .get(pid)
+            .ok()?
+            .capabilities()
+            .get(slot)
+            .ok()?
+            .resource()
+        {
+            Resource::Process(target) if self.process_exists(*target) => Some(*target),
+            _ => None,
+        }
+    }
+
+    /// Which slots of `pid`'s capability table are occupied.
+    pub fn cap_slots_for_test(&self, pid: ProcessId) -> [bool; 64] {
+        let mut used = [false; 64];
+        if let Ok(p) = self.processes.get(pid) {
+            for (slot, _) in p.capabilities().iter() {
+                used[slot.value() as usize] = true;
+            }
+        }
+        used
+    }
+
     pub fn thread_state_for_test(&self, tid: ThreadId) -> Option<ThreadState> {
         self.threads.get(tid).ok().map(|t| *t.state())
     }