Object-capability mesh and forensic record-replay

A Kern service's identity on the network is now the SHA-256 of its own reproducible binary: kern_attest_self_hash() measures the running executable, so peers recognise a service by a hash they can rebuild themselves, with no certificate authority. Ed25519-signed challenges prove liveness, capability tokens carry what a caller may ask, the compiler injects a per-call guard on RPC serve, and the server attests back in an X-Kern-Server-Attest header. The mesh is bidirectional: the token proves who is calling and what they may ask, the attestation proves which build is answering.

Unset config means disabled, fully backward compatible. Forensic record-replay welds nondeterminism to the audit chain: KERN_RECORD captures every clock read and random draw to a SHA-256-chained trace, KERN_REPLAY re-executes the incident run with byte-identical inputs, and kern_replay_verify() detects a trace edited after the fact. Built for DORA/NIS2 incident reconstruction, and a debugging tool for the heisenbug class.