feat(apps): permission manager equips apps (manifest+consent+decisions in /system), launches via init w/ file grant; shell unprivileged (/home); install/apps/allow/revoke; revoke stops running app; app-image tool; counter app

crates/apps/snake/manifest.toml

@@ -0,0 +1,9 @@
+[app]
+id      = "kos.snake"
+name    = "Snake"
+version = "1.0.0"
+binary  = "snake"
+author  = "K-OS"
+
+[capabilities]
+required = ["display"]