feat(kernel): object lifetimes via slot generations

- SlotGenerations per table, never wraps, retires exhausted slots
- caps to dead/reused process, endpoint, region rejected
- endpoints owned, die w/ owner, waiters woken w/ error
- DropCap syscall + libkos wrapper
- irq table bounds-checked, routes dropped w/ thread
- self-kill terminates caller, exit_thread full cleanup
- sched run_now: switch to named thread, not queue head
- lifetime tests, fuzz kills/recreates, kani gen proofs

crates/kernel/src/syscall/capability.rs

@@ -59,4 +59,19 @@ impl<P: Platform> Kernel<P> {
         self.revoke_resource(&resource);
         SyscallOutcome::Complete(SyscallResult::Ok)
     }
+
+    pub(crate) fn handle_drop_cap(
+        &mut self,
+        caller_pid: types::id::ProcessId,
+        slot: types::bounded::CapSlot,
+    ) -> SyscallOutcome {
+        let result = self
+            .processes
+            .get_mut(caller_pid)
+            .and_then(|p| p.capabilities_mut().remove(slot));
+        SyscallOutcome::Complete(match result {
+            Ok(()) => SyscallResult::Ok,
+            Err(e) => SyscallResult::Error(e),
+        })
+    }
 }