feat(kernel): object lifetimes via slot generations

- SlotGenerations per table, never wraps, retires exhausted slots
- caps to dead/reused process, endpoint, region rejected
- endpoints owned, die w/ owner, waiters woken w/ error
- DropCap syscall + libkos wrapper
- irq table bounds-checked, routes dropped w/ thread
- self-kill terminates caller, exit_thread full cleanup
- sched run_now: switch to named thread, not queue head
- lifetime tests, fuzz kills/recreates, kani gen proofs

crates/libkos/src/syscall.rs

@@ -80,6 +80,11 @@ pub fn revoke(slot: CapSlot) -> bool {
     arch::syscall1(SYS_REVOKE, slot.value() as usize) == 0
 }
 
+/// Removes a capability from this process's own table, freeing the slot.
+pub fn drop_cap(slot: CapSlot) -> bool {
+    arch::syscall1(SYS_DROP_CAP, slot.value() as usize) == 0
+}
+
 pub fn debug_putchar(byte: u8) {
     arch::syscall1(SYS_DEBUG_PUTCHAR, byte as usize);
 }