feat(kernel): SystemControl cap for halt, board device table + boot caps to init, RegionAddress syscall, idle loop services irqs

docs/ipc.md

@@ -48,6 +48,26 @@ as `cap`: deleting or revoking `cap` unmaps it. `perms` needs `Read`, plus
 | Notification | Read       | `Wait`, `Poll`, `BindNotification`         |
 | Notification | Delegate   | `Mint`                                     |
 | Interrupt    | Execute    | `SetIrqNotification`, `AckInterrupt`       |
+| Region       | Read       | `MapRegion` (read-only), `RegionAddress`   |
+| SystemControl| Execute    | `Halt`                                     |
+
+## Boot authority
+
+No process is privileged by its id. At boot the kernel gives init:
+
+- a `ProcessCreate` capability in slot 0;
+- for every device in the board table, a capability to its MMIO region
+  (`Read`, `Write`, `Delegate`; never `Execute`) and, if it interrupts, one
+  to its IRQ line (`Execute`, `Delegate`);
+- one `SystemControl` capability (`Execute`, `Delegate`).
+
+The board capabilities come after the capabilities boot code hands out
+for the built-in servers, so those slots are unchanged. Device regions
+never overlap each other or the frame pool, and each device has exactly
+one region, so delegating or revoking it means the same thing everywhere.
+
+`RegionAddress(cap)` returns a region's physical base so a driver can
+program a device's DMA; pool regions are physically contiguous.
 
 ## Messages