feat(kernel): kernel-owned memory model

- FrameTable: per-frame owner/use, replaces PagePool + ProcessMemory
- Quota per process, page tables charged to owner
- Regions for shared mem + device MMIO, torn down w/ owner
- Platform: create/destroy AS, map/unmap, zero_frame; drop translate_va
- RequestPages/ReleasePages/MapPage(move) checked vs kernel records
- user window 0x1000..32MiB, private pts by construction
- boot loader + device setup go through kernel api
- kernel built in place, boot allocator bounded
- isolation tests, randomized invariant test, FrameTable kani proofs
- fixes: inflated release, unmapped release, dst va unchecked,
  heap overflow, unbounded pt alloc, unzeroed frames, double free

crates/adapter-riscv/src/boot_fs.rs

@@ -1,11 +1,9 @@
 use crate::hw::virtio_blk::VirtioBlk;
 
 const SECTOR_SIZE: usize = 512;
-const MAX_FILE_SIZE: usize = 64 * 1024; // 64K max for init binary
 
 struct BootFat16 {
     reserved_sectors: u16,
-    sectors_per_fat: u16,
     root_dir_start: u32,
     root_dir_sectors: u32,
     data_start: u32,
@@ -31,12 +29,11 @@ impl BootFat16 {
 
         let fat_start = reserved_sectors as u32;
         let root_dir_start = fat_start + (num_fats as u32) * (sectors_per_fat as u32);
-        let root_dir_sectors = ((root_entry_count as u32) * 32 + 511) / 512;
+        let root_dir_sectors = ((root_entry_count as u32) * 32).div_ceil(512);
         let data_start = root_dir_start + root_dir_sectors;
 
         Some(Self {
             reserved_sectors,
-            sectors_per_fat,
             root_dir_start,
             root_dir_sectors,
             data_start,
@@ -84,7 +81,7 @@ pub fn read_file_from_disk(
     let mut found = false;
 
     for s in 0..fs.root_dir_sectors {
-        if !blk.read_sector((fs.root_dir_start + s) as u32, &mut sector_buf) {
+        if !blk.read_sector(fs.root_dir_start + s, &mut sector_buf) {
             continue;
         }
         for i in 0..(SECTOR_SIZE / 32) {
@@ -121,7 +118,7 @@ pub fn read_file_from_disk(
     let mut cluster = first_cluster;
     let sectors_per_cluster = fs.sectors_per_cluster as u32;
 
-    while read < size && cluster >= 2 && cluster < 0xFFF8 {
+    while read < size && (2..0xFFF8).contains(&cluster) {
         for s in 0..sectors_per_cluster {
             if read >= size {
                 break;