feat(kernel): kernel-owned memory model

- FrameTable: per-frame owner/use, replaces PagePool + ProcessMemory
- Quota per process, page tables charged to owner
- Regions for shared mem + device MMIO, torn down w/ owner
- Platform: create/destroy AS, map/unmap, zero_frame; drop translate_va
- RequestPages/ReleasePages/MapPage(move) checked vs kernel records
- user window 0x1000..32MiB, private pts by construction
- boot loader + device setup go through kernel api
- kernel built in place, boot allocator bounded
- isolation tests, randomized invariant test, FrameTable kani proofs
- fixes: inflated release, unmapped release, dst va unchecked,
  heap overflow, unbounded pt alloc, unzeroed frames, double free

crates/kernel/src/tests/mod.rs

@@ -3,7 +3,9 @@ mod mock_platform;
 
 mod capability;
 mod exit;
+mod invariants;
 mod ipc;
+mod isolation;
 mod lifecycle;
 mod memory;
 mod simple;
@@ -13,7 +15,6 @@ pub use helpers::{kernel_with_process, test_kernel};
 pub use mock_platform::MockPlatform;
 
 pub use crate::Kernel;
-pub use domain::memory::page_pool::PagePool;
 pub use types::address::PhysicalAddress;
 pub use types::bounded::Priority;
 pub use types::id::ProcessId;