feat: kernel W^X (per-section perms, firmware unmapped, stack guard, boot check), halt on kernel faults, region W^X across processes

docs/ipc.md

@@ -37,7 +37,11 @@ from a revocation further up.
 
 A region mapping made with `MapRegion(cap, va, perms)` lasts only as long
 as `cap`: deleting or revoking `cap` unmaps it. `perms` needs `Read`, plus
-`Write` for read-write or `Execute` for read-execute.
+`Write` for read-write or `Execute` for read-execute. W^X holds across
+processes: while a region is mapped read-write anywhere it cannot be mapped
+read-execute anywhere, and the other way round (`PermissionDenied`). To
+load code, map it writable, fill it, drop that mapping, then map it
+executable.
 
 | Object       | Permission | Allows                                     |
 |--------------|------------|--------------------------------------------|