[K1][OS-04] Virtualized Rust-kernel substrate

Programme: #1
Epic: #34

## Objective
Build the minimal capability-oriented Rust kernel substrate in a resettable VM before attempting physical-hardware desktop support.

## Scope
- Boot path for selected architecture/firmware target under virtualization.
- Physical/virtual memory management, address spaces and page-fault handling.
- User processes, scheduler, timers and process lifecycle.
- Capability/handle model and explicit IPC primitives.
- Interrupt/exception handling and kernel diagnostics.
- Basic filesystem/storage abstraction and virtual block driver.
- Basic networking stack/interface and virtual NIC driver or carefully selected reusable components.
- Console/input and minimal user-space init/runtime.
- Kernel panic/crash capture, test harness and image build/reproducibility pipeline.

## Architecture rules
- AI/browser code runs in unprivileged user processes, never kernel address space.
- Capability transfer is explicit; no ambient global object access by default.
- Every unsafe boundary and hardware-facing component has an owner/audit strategy.

## Acceptance criteria
- [ ] Resettable VM boots deterministically into a user-space init/process.
- [ ] Two unprivileged processes are isolated and communicate only through declared IPC/capability transfer.
- [ ] Invalid memory/capability accesses are contained to the appropriate failure boundary.
- [ ] Basic file/network/timer workloads pass deterministic integration tests.
- [ ] Worker/process crash does not require full-system corruption/reinstall and diagnostic state is recoverable.
- [ ] Kernel images/tests are produced by an automated CI path with versioned artifacts.

## Dependencies
- OS-03

**First phase:** K1
**Maturity target:** K1
**Owner:** os-systems

No files, tests, or entry points are named; begin by reviewing dependency OS-03 and clarifying the K1 first-phase boundary with the os-systems owner. Done requires a deterministic VM boot, isolated unprivileged processes with declared IPC and capability transfer, deterministic workload tests, recoverable crash diagnostics, and automated versioned CI artifacts.

Written by the indexing model from the issue text.