perf(kernel): kernel static all-zero -> .bss (image 812K -> 173K): domain::Slot (repr(u8) Empty=0) for tables, zero generation counters, core ids by position, pool/platform installed at boot; Option-backed Slot under kani (cbmc speed); build fails if .data > 16K

Makefile

@@ -61,6 +61,12 @@ PROGRAMS = -p init -p echo -p sleep -p snake \
 build:
 	cargo build --target $(RISCV_TARGET) --release $(PROGRAMS)
 	cargo build --target $(RISCV_TARGET) --release -p adapter-riscv
+	@# The kernel's tables are one static: if every empty entry is zero it
+	@# lives in .bss and costs nothing in the image (see domain::slot).
+	@data=$$(llvm-size -A $(KERNEL_BIN) | awk '$$1 == ".data" { print $$2 }'); \
+	if [ "$${data:-0}" -gt 16384 ]; then \
+		echo "kernel .data is $$data bytes: some table's empty value is not all zero bytes (use domain::slot::Slot)"; exit 1; \
+	fi
 
 # The keystore holds the owner's sealed keys: made once, never rebuilt.
 KEYS_IMG ?= keys.img