feat(kernel): derivation-tree revocation, region caps

- caps record parent (mint/delegate/ipc), CapRef w/ pid+slot gens
- Revoke = delete subtree, keep self; drop/death re-parents children
- CreateRegion/MapRegion; mapping lives only as long as its cap
- drop Permission::Revoke + object-wide revoke
- mint any cap (badge only ep/ntfn), process caps delegable
- kani: descendants == subtree; model-based fuzz vs spec

crates/types/src/permission.rs

@@ -4,7 +4,6 @@ pub enum Permission {
     Write,
     Execute,
     Delegate,
-    Revoke,
 }
 
 impl Permission {

crates/types/src/syscall_abi.rs

@@ -34,6 +34,13 @@ pub const SYS_WAIT: usize = 29;
 pub const SYS_POLL: usize = 30;
 pub const SYS_BIND_NOTIFICATION: usize = 31;
 pub const SYS_SET_IRQ_NOTIFICATION: usize = 32;
+pub const SYS_CREATE_REGION: usize = 33;
+pub const SYS_MAP_REGION: usize = 34;
+
+/// `PagePerms` in a register.
+pub const PERMS_READ_ONLY: usize = 0;
+pub const PERMS_READ_WRITE: usize = 1;
+pub const PERMS_READ_EXECUTE: usize = 2;
 
 /// "No capability" in a capability argument or result register.
 pub const NONE: usize = usize::MAX;