feat(kernel): derivation-tree revocation, region caps

- caps record parent (mint/delegate/ipc), CapRef w/ pid+slot gens
- Revoke = delete subtree, keep self; drop/death re-parents children
- CreateRegion/MapRegion; mapping lives only as long as its cap
- drop Permission::Revoke + object-wide revoke
- mint any cap (badge only ep/ntfn), process caps delegable
- kani: descendants == subtree; model-based fuzz vs spec

crates/kernel/src/tests/mod.rs

@@ -2,6 +2,7 @@ mod helpers;
 mod mock_platform;
 
 mod capability;
+mod captree_model;
 mod exit;
 mod invariants;
 mod ipc;
@@ -10,6 +11,7 @@ mod isolation;
 mod lifecycle;
 mod lifetimes;
 mod memory;
+mod revocation;
 mod simple;
 mod tick;