feat(kernel): kernel-owned memory model

- FrameTable: per-frame owner/use, replaces PagePool + ProcessMemory
- Quota per process, page tables charged to owner
- Regions for shared mem + device MMIO, torn down w/ owner
- Platform: create/destroy AS, map/unmap, zero_frame; drop translate_va
- RequestPages/ReleasePages/MapPage(move) checked vs kernel records
- user window 0x1000..32MiB, private pts by construction
- boot loader + device setup go through kernel api
- kernel built in place, boot allocator bounded
- isolation tests, randomized invariant test, FrameTable kani proofs
- fixes: inflated release, unmapped release, dst va unchecked,
  heap overflow, unbounded pt alloc, unzeroed frames, double free

Makefile

@@ -15,6 +15,7 @@ kernel-fmt:
 
 kernel-clippy:
 	cargo clippy $(KERNEL_CRATES) --all-targets -- -D warnings
+	cargo clippy -p adapter-riscv --target $(RISCV_TARGET) --no-deps -- -D warnings
 
 kernel-test:
 	cargo test $(KERNEL_CRATES)