[K3-K4][OS-06] Compatibility, hardware and supported Rust OS release

Programme: #1
Epic: #34

## Objective
Move the Rust-kernel track from virtualized research to a supportable operating system on declared hardware with browser/application compatibility, secure updates, recovery and full product conformance.

## Scope
- Browser/runtime compatibility strategy: native ports, ABI compatibility layer and/or isolated compatibility VM as selected by OS-03 evidence.
- Toolchains and runtime dependencies required by Chromium/alternative browser engines, local inference, speech and extension tooling.
- Physical drivers: storage, networking, USB, input, audio, display/GPU and required accelerator classes.
- Power management, suspend/resume, thermal reporting and battery support.
- Secure boot chain, signed system/application updates, rollback and recovery environment.
- Encrypted user storage, multi-user/session isolation, credential/key recovery and factory/reset flows.
- Accessibility primitives and supported assistive-technology path.
- Application/package distribution model and compatibility/support matrix.
- Long-term security response, driver ownership and hardware lifecycle policy.

## Release rules
- Support is declared per tested hardware/configuration; unsupported hardware is not implied by architecture.
- Compatibility VMs/layers must preserve the runtime capability/security model rather than becoming an ambient-privilege escape hatch.
- Application crates are not moved into kernel privilege merely to increase the amount of Rust in kernel space.

## Acceptance criteria
- [ ] Declared reference hardware boots, suspends/resumes and recovers reliably across the release test matrix.
- [ ] Full supported browser/workspace/speech/local-AI/file/desktop workflow suite passes on the declared hardware set.
- [ ] Browser/application compatibility path is measured and documented, including performance/isolation costs.
- [ ] Signed update failure and rollback cannot strand the user without a deterministic recovery path.
- [ ] Encrypted storage/key recovery and multi-user isolation pass threat-model/conformance tests.
- [ ] Security patch/driver maintenance ownership and hardware support lifetime are documented before general release.

## Dependencies
- OS-05
- EVAL-02
- EVAL-04

**First phase:** K3
**Maturity target:** K4 supported release
**Owner:** os-systems

Start by reading the OS-05, EVAL-02 and EVAL-04 dependencies, then use the declared hardware, release rules and acceptance criteria as the planning boundary. Done requires a supported release plan covering hardware workflows, compatibility measurement, recovery after update failure, encrypted storage and isolation tests, plus documented maintenance ownership and hardware lifetime.

Written by the indexing model from the issue text.