feat(kernel): kernel-owned memory model

- FrameTable: per-frame owner/use, replaces PagePool + ProcessMemory
- Quota per process, page tables charged to owner
- Regions for shared mem + device MMIO, torn down w/ owner
- Platform: create/destroy AS, map/unmap, zero_frame; drop translate_va
- RequestPages/ReleasePages/MapPage(move) checked vs kernel records
- user window 0x1000..32MiB, private pts by construction
- boot loader + device setup go through kernel api
- kernel built in place, boot allocator bounded
- isolation tests, randomized invariant test, FrameTable kani proofs
- fixes: inflated release, unmapped release, dst va unchecked,
  heap overflow, unbounded pt alloc, unzeroed frames, double free

crates/adapter-riscv/src/kernel_cell.rs

@@ -18,8 +18,13 @@ impl<T> KernelCell<T> {
         }
     }
 
-    pub fn init(&self, value: T) {
-        unsafe { (*self.inner.get()).write(value) };
+    /// Initializes the cell by letting `build` write the value straight
+    /// into its storage, so a large `T` never lives on the stack.
+    ///
+    /// # Safety
+    /// `build` must fully initialize the `T` behind the pointer.
+    pub unsafe fn init_with(&self, build: impl FnOnce(*mut T)) {
+        build(unsafe { (*self.inner.get()).as_mut_ptr() });
         self.initialized.store(true, Ordering::Release);
     }