feat(kernel): per-process budgets (pages, endpoints, notifs, regions) carved from creator, returned on death; init owns pool

docs/ipc.md

@@ -160,6 +160,20 @@ set it stays masked.
 - If the caller dies, the reply slot is simply stale and `Reply` is a
   successful no-op.
 
+## Budgets
+
+Every process has a budget: frames (its pages, page tables and regions'
+pages) and how many endpoints, notifications and regions it may own. Init
+starts with the whole frame pool and every table's capacity.
+`CreateProcess(create, pages, endpoints, notifications, regions)` carves
+the child's limits out of the caller's unused budget (`OutOfMemory` if it
+does not fit); boot carves the servers it loads out of init's. Over budget,
+page requests fail with `OutOfMemory` and object creation with `NoFreeSlot`.
+The limits of all live processes never add up to more than init got.
+
+When a process dies its limits go back to its parent, and its children
+pass to that parent, so their budgets return there in turn.
+
 ## Death
 
 Destroying an endpoint or notification wakes every thread blocked on it with