feat(kernel): kernel-owned memory model

- FrameTable: per-frame owner/use, replaces PagePool + ProcessMemory
- Quota per process, page tables charged to owner
- Regions for shared mem + device MMIO, torn down w/ owner
- Platform: create/destroy AS, map/unmap, zero_frame; drop translate_va
- RequestPages/ReleasePages/MapPage(move) checked vs kernel records
- user window 0x1000..32MiB, private pts by construction
- boot loader + device setup go through kernel api
- kernel built in place, boot allocator bounded
- isolation tests, randomized invariant test, FrameTable kani proofs
- fixes: inflated release, unmapped release, dst va unchecked,
  heap overflow, unbounded pt alloc, unzeroed frames, double free

crates/types/src/mapping.rs

@@ -6,3 +6,22 @@ pub struct Mapping<F> {
     pub pages: usize,
     pub flags: F,
 }
+
+/// Access rights of a user page. Writable-and-executable has no variant,
+/// so W^X holds for every mapping the kernel can express.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum PagePerms {
+    ReadOnly,
+    ReadWrite,
+    ReadExecute,
+}
+
+impl PagePerms {
+    pub const fn writable(self) -> bool {
+        matches!(self, Self::ReadWrite)
+    }
+
+    pub const fn executable(self) -> bool {
+        matches!(self, Self::ReadExecute)
+    }
+}