feat(kernel): kernel-owned memory model

- FrameTable: per-frame owner/use, replaces PagePool + ProcessMemory
- Quota per process, page tables charged to owner
- Regions for shared mem + device MMIO, torn down w/ owner
- Platform: create/destroy AS, map/unmap, zero_frame; drop translate_va
- RequestPages/ReleasePages/MapPage(move) checked vs kernel records
- user window 0x1000..32MiB, private pts by construction
- boot loader + device setup go through kernel api
- kernel built in place, boot allocator bounded
- isolation tests, randomized invariant test, FrameTable kani proofs
- fixes: inflated release, unmapped release, dst va unchecked,
  heap overflow, unbounded pt alloc, unzeroed frames, double free

crates/adapter-riscv/src/mmu/mod.rs

@@ -3,6 +3,6 @@ pub mod page_table;
 
 pub use allocator::init_allocator;
 pub use page_table::{
-    Mapping, PAGE_SIZE, PageTable, Sv39Flags, activate, create_user_page_table,
-    init_kernel_page_table, map, translate,
+    PAGE_SIZE, PageTable, Sv39Flags, USER_VA_END, USER_VA_START, activate, active_root,
+    create_user_root, init_kernel_page_table, map_user_page, unmap_user_page,
 };