feat(kernel): kernel-owned memory model

- FrameTable: per-frame owner/use, replaces PagePool + ProcessMemory
- Quota per process, page tables charged to owner
- Regions for shared mem + device MMIO, torn down w/ owner
- Platform: create/destroy AS, map/unmap, zero_frame; drop translate_va
- RequestPages/ReleasePages/MapPage(move) checked vs kernel records
- user window 0x1000..32MiB, private pts by construction
- boot loader + device setup go through kernel api
- kernel built in place, boot allocator bounded
- isolation tests, randomized invariant test, FrameTable kani proofs
- fixes: inflated release, unmapped release, dst va unchecked,
  heap overflow, unbounded pt alloc, unzeroed frames, double free

crates/adapter-riscv/src/mmu/allocator.rs

@@ -1,7 +1,9 @@
 use super::page_table::{PAGE_SIZE, PageTable};
+use crate::board;
 
-// Boot-time bump allocator for page tables.
-// Only used during init before the scheduler starts.
+// Boot-time bump allocator for kernel-only memory: the kernel page table
+// and boot scratch buffers. User memory and user page tables come from the
+// kernel's frame table instead. It must never reach the user pool.
 static mut NEXT_FREE: usize = 0;
 
 pub fn init_allocator(start: usize) {
@@ -13,6 +15,9 @@ pub fn init_allocator(start: usize) {
 pub fn alloc_zeroed_page() -> usize {
     unsafe {
         let addr = NEXT_FREE;
+        if addr + PAGE_SIZE > board::USER_POOL_BASE {
+            crate::halt(&crate::hw::uart::Uart::new(), "boot allocator exhausted");
+        }
         NEXT_FREE += PAGE_SIZE;
         core::ptr::write_bytes(addr as *mut u8, 0, PAGE_SIZE);
         addr
@@ -20,9 +25,5 @@ pub fn alloc_zeroed_page() -> usize {
 }
 
 pub fn alloc_page_table() -> &'static mut PageTable {
-    unsafe {
-        let addr = alloc_zeroed_page();
-        let table = &mut *(addr as *mut PageTable);
-        table
-    }
+    unsafe { &mut *(alloc_zeroed_page() as *mut PageTable) }
 }