feat(kernel): object lifetimes via slot generations

- SlotGenerations per table, never wraps, retires exhausted slots
- caps to dead/reused process, endpoint, region rejected
- endpoints owned, die w/ owner, waiters woken w/ error
- DropCap syscall + libkos wrapper
- irq table bounds-checked, routes dropped w/ thread
- self-kill terminates caller, exit_thread full cleanup
- sched run_now: switch to named thread, not queue head
- lifetime tests, fuzz kills/recreates, kani gen proofs

crates/domain/src/capability/tests.rs

@@ -83,7 +83,7 @@ fn full_table_returns_no_free_slot() {
 #[test]
 fn generation_mismatch_detected() {
     let gen_v1 = Generation::initial();
-    let gen_v2 = gen_v1.next();
+    let gen_v2 = gen_v1.next().unwrap();
 
     assert!(gen_v1.is_valid_against(&gen_v1));
     assert!(!gen_v1.is_valid_against(&gen_v2));