refactor: unsafe only in adapter + libkos; forbid(unsafe_code) everywhere else; libkos Window (volatile, bounds-checked MMIO/DMA/shared mem), entry!, thread::spawn; MapRegion returns pages; kernel const-built (with_cores/install_platform); newtype addrs

crates/adapter-riscv/src/kernel_cell.rs

@@ -11,22 +11,15 @@ pub struct KernelCell<T> {
 unsafe impl<T> Sync for KernelCell<T> {}
 
 impl<T> KernelCell<T> {
-    pub const fn uninit() -> Self {
+    /// Holds `value` from the start: built at compile time, so a large `T`
+    /// never lives on the stack.
+    pub const fn new(value: T) -> Self {
         Self {
-            initialized: AtomicBool::new(false),
-            inner: UnsafeCell::new(MaybeUninit::uninit()),
+            initialized: AtomicBool::new(true),
+            inner: UnsafeCell::new(MaybeUninit::new(value)),
         }
     }
 
-    /// Initializes in place, so a large `T` never lives on the stack.
-    ///
-    /// # Safety
-    /// `build` must fully initialize the `T` behind the pointer.
-    pub unsafe fn init_with(&self, build: impl FnOnce(*mut T)) {
-        build(unsafe { (*self.inner.get()).as_mut_ptr() });
-        self.initialized.store(true, Ordering::Release);
-    }
-
     /// Raw pointer to the kernel; callers must avoid aliasing `&mut`.
     pub fn as_ptr(&self) -> *mut T {
         debug_assert!(self.initialized.load(Ordering::Acquire));