feat(init): spawn service over IPC with per-client allowance refunded on child death; up to 4 death watchers; spawntest on test image

docs/ipc.md

@@ -84,6 +84,18 @@ and budget listed there. Storage, started before the log server, receives
 its log endpoint from init later (`SET_LOG`, accepted only from the
 unbadged holder of its endpoint).
 
+Only init holds `ProcessCreate`. Everyone else runs programs through init's
+spawn service (`types::spawn`, client `libkos::spawn`), which init serves
+once boot is done. A manifest entry with `spawns` gets a badged copy of
+init's endpoint, the badge naming its allowance. `SPAWN(name, limits)` loads
+the program into a new, unstarted process, gives it a call-only log
+endpoint, and replies with the process capability (Execute and Read, no
+Delegate). The caller delegates whatever else the child should hold and
+starts it with `SpawnThreadIn`. The child's limits come out of the caller's
+allowance (`OVER_ALLOWANCE` if they do not fit) and go back when init hears
+the child die (`WatchDeath`, up to four watchers per process, so the caller
+can watch too).
+
 Device regions never overlap each other or the frame pool, and each device has exactly
 one region, so delegating or revoking it means the same thing everywhere.