feat(kernel): object lifetimes via slot generations

- SlotGenerations per table, never wraps, retires exhausted slots
- caps to dead/reused process, endpoint, region rejected
- endpoints owned, die w/ owner, waiters woken w/ error
- DropCap syscall + libkos wrapper
- irq table bounds-checked, routes dropped w/ thread
- self-kill terminates caller, exit_thread full cleanup
- sched run_now: switch to named thread, not queue head
- lifetime tests, fuzz kills/recreates, kani gen proofs

crates/kernel/src/syscall/capability.rs

@@ -59,4 +59,19 @@ impl<P: Platform> Kernel<P> {
         self.revoke_resource(&resource);
         SyscallOutcome::Complete(SyscallResult::Ok)
     }
+
+    pub(crate) fn handle_drop_cap(
+        &mut self,
+        caller_pid: types::id::ProcessId,
+        slot: types::bounded::CapSlot,
+    ) -> SyscallOutcome {
+        let result = self
+            .processes
+            .get_mut(caller_pid)
+            .and_then(|p| p.capabilities_mut().remove(slot));
+        SyscallOutcome::Complete(match result {
+            Ok(()) => SyscallResult::Ok,
+            Err(e) => SyscallResult::Error(e),
+        })
+    }
 }

crates/kernel/src/syscall/ipc.rs

@@ -8,7 +8,7 @@ impl<P: Platform> Kernel<P> {
         &mut self,
         caller_pid: types::id::ProcessId,
     ) -> SyscallOutcome {
-        let ep_id = match self.create_endpoint() {
+        let ep_id = match self.create_endpoint(caller_pid) {
             Ok(id) => id,
             Err(e) => return SyscallOutcome::Complete(SyscallResult::Error(e)),
         };

crates/kernel/src/syscall/lifecycle.rs

@@ -159,6 +159,10 @@ impl<P: Platform> Kernel<P> {
         };
 
         self.destroy_process(target_pid);
+        if target_pid == caller_pid {
+            // The caller no longer exists; nothing to return to.
+            return SyscallOutcome::TerminateCaller;
+        }
         SyscallOutcome::Complete(SyscallResult::Ok)
     }
 }

crates/kernel/src/syscall/mod.rs

@@ -48,6 +48,7 @@ impl<P: Platform> Kernel<P> {
             }
             Syscall::Kill { process } => self.handle_kill(pid, process),
             Syscall::Revoke { slot } => self.handle_revoke(pid, slot),
+            Syscall::DropCap { slot } => self.handle_drop_cap(pid, slot),
             Syscall::Delegate {
                 slot,
                 to_endpoint,

crates/kernel/src/syscall/simple.rs

@@ -70,10 +70,7 @@ impl<P: Platform> Kernel<P> {
         caller_tid: types::id::ThreadId,
         pid: types::id::ProcessId,
     ) -> SyscallOutcome {
-        use domain::scheduler::Scheduler;
-
-        self.scheduler.remove(caller_tid);
-        let _ = self.threads.destroy(caller_tid);
+        self.cleanup_threads(&[Some(caller_tid)]);
 
         if let Ok(process) = self.processes.get_mut(pid) {
             process.remove_thread(caller_tid);