feat(kernel): object lifetimes via slot generations

- SlotGenerations per table, never wraps, retires exhausted slots
- caps to dead/reused process, endpoint, region rejected
- endpoints owned, die w/ owner, waiters woken w/ error
- DropCap syscall + libkos wrapper
- irq table bounds-checked, routes dropped w/ thread
- self-kill terminates caller, exit_thread full cleanup
- sched run_now: switch to named thread, not queue head
- lifetime tests, fuzz kills/recreates, kani gen proofs

crates/domain/src/scheduler/per_core.rs

@@ -39,6 +39,15 @@ impl PerCoreScheduler {
         Some(thread)
     }
 
+    /// Takes `thread` out of the run queue and makes it current.
+    pub fn run_now(&mut self, thread: ThreadId) -> bool {
+        if !self.queue.remove(thread) {
+            return false;
+        }
+        self.current = Some(thread);
+        true
+    }
+
     pub fn clear_current(&mut self) {
         self.current = None;
     }