feat(kernel): kernel-owned memory model

- FrameTable: per-frame owner/use, replaces PagePool + ProcessMemory
- Quota per process, page tables charged to owner
- Regions for shared mem + device MMIO, torn down w/ owner
- Platform: create/destroy AS, map/unmap, zero_frame; drop translate_va
- RequestPages/ReleasePages/MapPage(move) checked vs kernel records
- user window 0x1000..32MiB, private pts by construction
- boot loader + device setup go through kernel api
- kernel built in place, boot allocator bounded
- isolation tests, randomized invariant test, FrameTable kani proofs
- fixes: inflated release, unmapped release, dst va unchecked,
  heap overflow, unbounded pt alloc, unzeroed frames, double free

crates/domain/src/error.rs

@@ -8,7 +8,10 @@ use types::{
 pub enum KernelError {
     InvalidSlot(CapSlot),
     RevokedCapability(CapSlot),
-    PermissionDenied { slot: CapSlot, needed: Permission },
+    PermissionDenied {
+        slot: CapSlot,
+        needed: Permission,
+    },
     NoFreeSlot,
     InvalidProcess(ProcessId),
     WouldBlock,
@@ -23,4 +26,9 @@ pub enum KernelError {
     EndpointFull,
     ProcessCreateDenied,
     IrqAlreadyOwned(IrqId),
+    /// Address outside the user window, unaligned, or not owned by the caller.
+    InvalidAddress,
+    /// The target virtual range already holds a mapping.
+    AddressInUse,
+    InvalidRegion,
 }