feat(kernel): kernel-owned memory model

- FrameTable: per-frame owner/use, replaces PagePool + ProcessMemory
- Quota per process, page tables charged to owner
- Regions for shared mem + device MMIO, torn down w/ owner
- Platform: create/destroy AS, map/unmap, zero_frame; drop translate_va
- RequestPages/ReleasePages/MapPage(move) checked vs kernel records
- user window 0x1000..32MiB, private pts by construction
- boot loader + device setup go through kernel api
- kernel built in place, boot allocator bounded
- isolation tests, randomized invariant test, FrameTable kani proofs
- fixes: inflated release, unmapped release, dst va unchecked,
  heap overflow, unbounded pt alloc, unzeroed frames, double free

crates/kernel/src/syscall/capability.rs

@@ -38,17 +38,10 @@ impl<P: Platform> Kernel<P> {
             Err(e) => return SyscallOutcome::Complete(SyscallResult::Error(e)),
         };
 
-        if let Err(e) = self.grant_cap(target_pid, resource.clone(), restricted) {
+        if let Err(e) = self.grant_cap(target_pid, resource, restricted) {
             return SyscallOutcome::Complete(SyscallResult::Error(e));
         }
 
-        if let domain::resource::Resource::Memory(region_id) = &resource
-            && let Some(region) = self.regions.get(*region_id)
-        {
-            self.platform
-                .map_shared(target_pid, region.base(), region.size(), restricted);
-        }
-
         SyscallOutcome::Complete(SyscallResult::Ok)
     }