refactor: unsafe only in adapter + libkos; forbid(unsafe_code) everywhere else; libkos Window (volatile, bounds-checked MMIO/DMA/shared mem), entry!, thread::spawn; MapRegion returns pages; kernel const-built (with_cores/install_platform); newtype addrs

docs/ADAPTERS.md

@@ -1,6 +1,6 @@
 # Writing Adapters
 
-An adapter implements the `Platform` trait for a specific architecture. It is the only crate with `unsafe` code.
+An adapter implements the `Platform` trait for a specific architecture. It is the only kernel-side crate with `unsafe` code; in userspace only `libkos` has any (the syscall instruction, `_start`, the allocator, and `Window`: the one way to touch device or shared memory). Every other crate, kernel and domain included, is `#![forbid(unsafe_code)]`.
 
 ## Scaffolding
 

docs/ipc.md

@@ -35,7 +35,8 @@ Deleting a capability (`DropCap`, or its process dying) makes its parent
 adopt its children, so stepping out of the chain never shields anyone
 from a revocation further up.
 
-A region mapping made with `MapRegion(cap, va, perms)` lasts only as long
+A region mapping made with `MapRegion(cap, va, perms)` returns how many
+pages it mapped (so userspace never reaches past them) and lasts only as long
 as `cap`: deleting or revoking `cap` unmaps it. `perms` needs `Read`, plus
 `Write` for read-write or `Execute` for read-execute. W^X holds across
 processes: while a region is mapped read-write anywhere it cannot be mapped