feat(kernel): object lifetimes via slot generations

- SlotGenerations per table, never wraps, retires exhausted slots
- caps to dead/reused process, endpoint, region rejected
- endpoints owned, die w/ owner, waiters woken w/ error
- DropCap syscall + libkos wrapper
- irq table bounds-checked, routes dropped w/ thread
- self-kill terminates caller, exit_thread full cleanup
- sched run_now: switch to named thread, not queue head
- lifetime tests, fuzz kills/recreates, kani gen proofs

crates/adapter-riscv/src/boot/caps.rs

@@ -23,7 +23,7 @@ pub fn grant_all(
         .with(types::permission::Permission::Execute);
 
     let storage_ep = kern()
-        .create_endpoint()
+        .create_endpoint(storage_pid)
         .unwrap_or_else(|_| crate::halt(uart, "storage endpoint failed"));
 
     kern()
@@ -50,7 +50,7 @@ pub fn grant_all(
         .unwrap_or_else(|_| crate::halt(uart, "grant failed"));
 
     let display_ep = kern()
-        .create_endpoint()
+        .create_endpoint(display_pid)
         .unwrap_or_else(|_| crate::halt(uart, "display endpoint failed"));
 
     kern()
@@ -77,7 +77,7 @@ pub fn grant_all(
         .unwrap_or_else(|_| crate::halt(uart, "grant failed"));
 
     let input_ep = kern()
-        .create_endpoint()
+        .create_endpoint(input_pid)
         .unwrap_or_else(|_| crate::halt(uart, "input endpoint failed"));
 
     kern()

crates/adapter-riscv/src/trap/mod.rs

@@ -251,6 +251,10 @@ fn decode_syscall(frame: &TrapFrame) -> Option<domain::syscall::Syscall> {
             })
         }
         SYS_CREATE_ENDPOINT => Some(Syscall::CreateEndpoint),
+        SYS_DROP_CAP => {
+            let slot = types::bounded::CapSlot::new(a0 as u8)?;
+            Some(Syscall::DropCap { slot })
+        }
         SYS_DEBUG_PUTCHAR => Some(Syscall::DebugPutchar { byte: a0 as u8 }),
         SYS_MAP_PAGE => {
             let slot = types::bounded::CapSlot::new(a0 as u8)?;