fix: harden kernel — eliminate UB, proper process cleanup

Critical: kernel_ref() UB eliminated
- kernel_ref() returned &'static mut, creating aliasing mutable
  references across trap handler + boot code (13+ call sites)
- Replaced with kernel_ptr() -> *mut Kernel, each use site does
  explicit unsafe { &mut *kernel_ptr() }
- KernelCell: removed get_mut(), added as_ptr() -> *mut T
- UB is gone: raw pointer access makes the single-core invariant
  explicit at every use site

Important: process cleanup on exit/fault
- New destroy_process() method consolidates cleanup:
  - Removes all threads from scheduler and endpoints
  - Clears pending messages and results
  - Destroys process and frees ProcessMemory
- handle_exit and handle_fault both use destroy_process()
- handle_exit_thread uses destroy_process when last thread exits

IPC hardening:
- Added invariant comment on pending_messages[sender].take()
  (sender in wait queue must have a pending message)

handle_release_pages:
- Now uses translate_va to convert VA→PA (was treating VA as PA)

crates/adapter-riscv/src/kernel_cell.rs

@@ -7,7 +7,7 @@ pub struct KernelCell<T> {
     inner: UnsafeCell<MaybeUninit<T>>,
 }
 
-// Single-core: no concurrent access. Initialized once before traps are enabled.
+// Single-core, interrupts disabled during kernel access.
 unsafe impl<T> Sync for KernelCell<T> {}
 
 impl<T> KernelCell<T> {
@@ -23,13 +23,11 @@ impl<T> KernelCell<T> {
         self.initialized.store(true, Ordering::Release);
     }
 
-    pub fn get(&self) -> &T {
+    /// Returns a raw pointer to the kernel. Callers must ensure
+    /// no aliasing `&mut` references exist. Safe on single-core
+    /// with interrupts disabled during kernel calls.
+    pub fn as_ptr(&self) -> *mut T {
         debug_assert!(self.initialized.load(Ordering::Acquire));
-        unsafe { (*self.inner.get()).assume_init_ref() }
-    }
-
-    pub fn get_mut(&self) -> &mut T {
-        debug_assert!(self.initialized.load(Ordering::Acquire));
-        unsafe { (*self.inner.get()).assume_init_mut() }
+        unsafe { (*self.inner.get()).as_mut_ptr() }
     }
 }