feat(kernel): kernel-owned memory model

- FrameTable: per-frame owner/use, replaces PagePool + ProcessMemory
- Quota per process, page tables charged to owner
- Regions for shared mem + device MMIO, torn down w/ owner
- Platform: create/destroy AS, map/unmap, zero_frame; drop translate_va
- RequestPages/ReleasePages/MapPage(move) checked vs kernel records
- user window 0x1000..32MiB, private pts by construction
- boot loader + device setup go through kernel api
- kernel built in place, boot allocator bounded
- isolation tests, randomized invariant test, FrameTable kani proofs
- fixes: inflated release, unmapped release, dst va unchecked,
  heap overflow, unbounded pt alloc, unzeroed frames, double free

crates/kernel/src/tests/helpers.rs

@@ -1,4 +1,3 @@
-use domain::memory::page_pool::PagePool;
 use domain::resource::Resource;
 use domain::scheduler::Scheduler;
 use domain::thread::ThreadState;
@@ -16,8 +15,7 @@ use crate::Kernel;
 
 pub fn test_kernel() -> Kernel<MockPlatform> {
     let mock = MockPlatform::new(1);
-    let pool = PagePool::new(PhysicalAddress::from_raw(0x8000_0000), 1024);
-    Kernel::new(mock, pool)
+    Kernel::new(mock, PhysicalAddress::from_raw(0x8400_0000), 1024)
 }
 
 pub fn kernel_with_process() -> (Kernel<MockPlatform>, ProcessId) {