feat(kernel): seL4-style IPC, notifications, status ABI

- badges + Mint, Call/Reply/ReplyRecv w/ gen-checked reply slot
- cap transfer (1/msg, copy, needs Delegate, rechecked at delivery)
- notifications: signal/wait/poll/bind, irq -> notification routing
- WaitAny/WaitForInterrupt removed; a0=status, ErrorCode
- libkos: single ecall primitive, compat wrappers + typed new api
- fix: trap return clobbered user t0 on every trap
- fix: wait queues FIFO, delegate keeps badge, fault cap checked
- docs/ipc.md spec, ipc tests, ipc fuzz, kani ntfn + waitqueue

crates/domain/src/capability/mod.rs

@@ -1,4 +1,4 @@
-use types::{bounded::CapSlot, generation::Generation, permission::PermissionSet};
+use types::{badge::Badge, bounded::CapSlot, generation::Generation, permission::PermissionSet};
 
 pub mod authority;
 
@@ -11,10 +11,12 @@ mod tests;
 // Sized so that every representable `CapSlot` indexes a real slot.
 pub const MAX_CAPS_PER_PROCESS: usize = CapSlot::MAX as usize + 1;
 
+#[derive(Clone)]
 pub struct Capability {
     resource: Resource,
     permissions: PermissionSet,
     generation: Generation,
+    badge: Badge,
 }
 
 impl Capability {
@@ -23,9 +25,20 @@ impl Capability {
             resource,
             permissions,
             generation,
+            badge: Badge::NONE,
         }
     }
 
+    /// The same capability with `badge` stamped on it.
+    pub fn with_badge(mut self, badge: Badge) -> Self {
+        self.badge = badge;
+        self
+    }
+
+    pub fn badge(&self) -> Badge {
+        self.badge
+    }
+
     pub fn resource(&self) -> &Resource {
         &self.resource
     }