feat(kernel): kernel-owned memory model

- FrameTable: per-frame owner/use, replaces PagePool + ProcessMemory
- Quota per process, page tables charged to owner
- Regions for shared mem + device MMIO, torn down w/ owner
- Platform: create/destroy AS, map/unmap, zero_frame; drop translate_va
- RequestPages/ReleasePages/MapPage(move) checked vs kernel records
- user window 0x1000..32MiB, private pts by construction
- boot loader + device setup go through kernel api
- kernel built in place, boot allocator bounded
- isolation tests, randomized invariant test, FrameTable kani proofs
- fixes: inflated release, unmapped release, dst va unchecked,
  heap overflow, unbounded pt alloc, unzeroed frames, double free

crates/adapter-riscv/src/boot/hardware.rs

@@ -1,6 +1,6 @@
 use crate::hw::uart::Uart;
 use crate::hw::virtio_blk::VirtioBlk;
-use crate::{KERNEL, board, kernel_cell::KernelCell, mmu, platform, trap};
+use crate::{KERNEL, board, mmu, platform, trap};
 
 unsafe extern "C" {
     static _bss_start: u8;
@@ -22,12 +22,21 @@ pub fn init(uart: &Uart) -> &'static mut mmu::PageTable {
     crate::hw::plic::Plic::init();
     uart.write_str("k-os: traps and timer initialized\n");
 
+    if board::USER_POOL_PAGES > domain::memory::frame::MAX_FRAMES {
+        crate::halt(uart, "user pool larger than the frame table");
+    }
     let riscv_platform = platform::RiscVPlatform::new(kernel_pt as *const mmu::PageTable as usize);
-    let pool = domain::memory::page_pool::PagePool::new(
-        types::address::PhysicalAddress::from_raw(board::USER_POOL_BASE),
-        board::USER_POOL_PAGES,
-    );
-    KERNEL.init(kernel::Kernel::new(riscv_platform, pool));
+    // SAFETY: `init_in_place` writes every field of the kernel.
+    unsafe {
+        KERNEL.init_with(|slot| {
+            kernel::Kernel::init_in_place(
+                slot,
+                riscv_platform,
+                types::address::PhysicalAddress::from_raw(board::USER_POOL_BASE),
+                board::USER_POOL_PAGES,
+            )
+        });
+    }
 
     kernel_pt
 }