feat(kernel): kernel-owned memory model

- FrameTable: per-frame owner/use, replaces PagePool + ProcessMemory
- Quota per process, page tables charged to owner
- Regions for shared mem + device MMIO, torn down w/ owner
- Platform: create/destroy AS, map/unmap, zero_frame; drop translate_va
- RequestPages/ReleasePages/MapPage(move) checked vs kernel records
- user window 0x1000..32MiB, private pts by construction
- boot loader + device setup go through kernel api
- kernel built in place, boot allocator bounded
- isolation tests, randomized invariant test, FrameTable kani proofs
- fixes: inflated release, unmapped release, dst va unchecked,
  heap overflow, unbounded pt alloc, unzeroed frames, double free

crates/kernel/src/syscall/lifecycle.rs

@@ -57,11 +57,10 @@ impl<P: Platform> Kernel<P> {
             Err(e) => return SyscallOutcome::Complete(SyscallResult::Error(e)),
         };
 
-        self.process_memory[new_pid.raw() as usize] =
-            Some(domain::memory::process_memory::ProcessMemory::new(
-                new_pid,
-                domain::memory::process_memory::ProcessMemory::DEFAULT_PAGE_LIMIT,
-            ));
+        if let Err(e) = self.create_address_space(new_pid) {
+            let _ = self.processes.destroy(new_pid);
+            return SyscallOutcome::Complete(SyscallResult::Error(e));
+        }
 
         match self.grant_cap(
             caller_pid,
@@ -73,8 +72,8 @@ impl<P: Platform> Kernel<P> {
             Ok(slot) => SyscallOutcome::Complete(SyscallResult::Slot(slot)),
             Err(e) => {
                 // Rollback: destroy orphaned process
+                self.teardown_memory(new_pid);
                 let _ = self.processes.destroy(new_pid);
-                self.process_memory[new_pid.raw() as usize] = None;
                 SyscallOutcome::Complete(SyscallResult::Error(e))
             }
         }