init policy cutover: recursive attenuate + bare export map enforcement

[lthibault]

Summary

• cut over init.glia return contract to bare export map ({:host host ...})
• reject legacy {:export {:caps ... :methods ...}} shape with clear migration error
• add recursive attenuate keyword form in Glia (:allow, :returns, :self)
• enforce attenuation at kernel/RPC proxy layer, including recursive wrapping of returned caps
• migrate example etc/init.glia files to new contract
• add docs for init orchestration and export policy

Commit Structure

1. executor: wait for export policy readiness with exact error codes
2. glia: add recursive attenuate with returns and self
3. kernel: enforce bare export map with recursive cap proxies
4. docs/examples: migrate init scripts to bare export map

Validation

• cargo test -p glia
• cargo test --manifest-path std/kernel/Cargo.toml
• cargo check -p ww -p system -p caps

Descriptor-CID Routing Unchanged (Proof)

• Routing key is still descriptor CID of canonical descriptor tuple {wasiCid,schemaCid}; no alternate routing/fallback path added.
• crates/rpc/src/vat_client.rs:
  • VatClient::dial still canonicalizes the descriptor and computes cid_for_descriptor_bytes(...) for /ww/0.1.0/vat/{cid} routing.
  • TypedCap.schema authority now comes strictly from local descriptor.schemaCid lookup (schema_bytes_for_descriptor_cid), with explicit fail-closed error on unresolved/invalid values.
• crates/rpc/src/vat_dial.rs:
  • WWSC preface framing removed; vat stream goes directly into Cap'n Proto bootstrap (twoparty::VatNetwork + rpc_twoparty_capnp::Side::Server).
• crates/rpc/src/vat_listener.rs:
  • Listener-side schema-preface write removed; stream begins RPC immediately.
  • Existing descriptor consistency gate (served_schema_cid vs expected descriptor schema CID) remains intact.

[lthibault]

Closing this long-running branch PR as superseded by a clean fresh-from-master PR workflow. We’ll reopen as a new focused PR.

[lthibault]

Superseding this PR with #528 to align with the original plan requirement: new clean branch from origin/master, then apply the full producer-authority + descriptor-CID changes there. Closing this one to avoid split review history and stale scope drift.