feat(kernel): kernel-owned memory model

- FrameTable: per-frame owner/use, replaces PagePool + ProcessMemory
- Quota per process, page tables charged to owner
- Regions for shared mem + device MMIO, torn down w/ owner
- Platform: create/destroy AS, map/unmap, zero_frame; drop translate_va
- RequestPages/ReleasePages/MapPage(move) checked vs kernel records
- user window 0x1000..32MiB, private pts by construction
- boot loader + device setup go through kernel api
- kernel built in place, boot allocator bounded
- isolation tests, randomized invariant test, FrameTable kani proofs
- fixes: inflated release, unmapped release, dst va unchecked,
  heap overflow, unbounded pt alloc, unzeroed frames, double free

crates/adapter-riscv/src/main.rs

@@ -41,16 +41,15 @@ extern "C" fn kmain() -> ! {
     let uart = Uart::new();
     uart.write_str("k-os: booted on RISC-V\n");
 
-    let kernel_pt = boot::hardware::init(&uart);
+    boot::hardware::init(&uart);
     let mut blk =
         boot::hardware::probe_block_device(&uart).unwrap_or_else(|| halt(&uart, "no block device"));
 
-    let (init, _) = boot::loader::load_init(&uart, &mut blk, kernel_pt);
-    let storage = boot::loader::load_server(&uart, &mut blk, kernel_pt, b"storage.elf", "storage");
-    let display = boot::loader::load_server(&uart, &mut blk, kernel_pt, b"display.elf", "display");
-    let input = boot::loader::load_server(&uart, &mut blk, kernel_pt, b"input.elf", "input");
+    let (init, _) = boot::loader::load_init(&uart, &mut blk);
+    let storage = boot::loader::load_server(&uart, &mut blk, b"storage.elf", "storage");
+    let display = boot::loader::load_server(&uart, &mut blk, b"display.elf", "display");
+    let input = boot::loader::load_server(&uart, &mut blk, b"input.elf", "input");
     let virtio_base = blk.base();
-    drop(blk);
 
     devices::storage_setup::configure(&uart, init.pid, storage.pid, virtio_base);
     devices::gpu_setup::configure(&uart, display.pid);