fix: harden kernel — eliminate UB, proper process cleanup

Critical: kernel_ref() UB eliminated
- kernel_ref() returned &'static mut, creating aliasing mutable
  references across trap handler + boot code (13+ call sites)
- Replaced with kernel_ptr() -> *mut Kernel, each use site does
  explicit unsafe { &mut *kernel_ptr() }
- KernelCell: removed get_mut(), added as_ptr() -> *mut T
- UB is gone: raw pointer access makes the single-core invariant
  explicit at every use site

Important: process cleanup on exit/fault
- New destroy_process() method consolidates cleanup:
  - Removes all threads from scheduler and endpoints
  - Clears pending messages and results
  - Destroys process and frees ProcessMemory
- handle_exit and handle_fault both use destroy_process()
- handle_exit_thread uses destroy_process when last thread exits

IPC hardening:
- Added invariant comment on pending_messages[sender].take()
  (sender in wait queue must have a pending message)

handle_release_pages:
- Now uses translate_va to convert VA→PA (was treating VA as PA)

crates/adapter-riscv/src/devices/input_setup.rs

@@ -1,11 +1,12 @@
 use crate::hw::uart::Uart;
-use crate::{board, kernel_ref, mmu};
+use crate::{board, mmu};
 use types::id::ProcessId;
 
 const UART_VA: usize = 0x20000;
 
 pub fn configure(uart: &Uart, input_pid: ProcessId) {
-    let pt_addr = kernel_ref().platform_mut().page_table_for(input_pid);
+    let kern = unsafe { &mut *crate::kernel_ptr() };
+    let pt_addr = kern.platform_mut().page_table_for(input_pid);
     let pt = unsafe { &mut *(pt_addr as *mut mmu::PageTable) };
 
     mmu::map(pt, mmu::Mapping {