feat(os): OS operator kernels in CUBE + thin native effector (Steps 1 & 2)

- cubecode/src/cb.rs: Behavior descriptor bitflag (PURE/IO_HEAVY/HOT_PATH)
  encoded into HeaderFlags bits 13..15; C_OS_KERNEL=210 / C_OS_EFFECT=211
  coordinate bands; round-trip unit test.
- fix: HEADER_FLAG_BEHAVIOR mask was 0x7000 (bits 12-14) which grabbed the
  ENCRYPTED bit (12) and dropped HOT_PATH (bit 15). Corrected to 0xE000.
- store_code_cell/put_code_cell/header_for_code gain optional descriptor arg;
  all 12 prior call sites pass None (total change).
- CLI: prog K=<flag> tokens, kernel verb (links+descriptors), tick verb lays
  down the OS kernel call-graph (cfg->decide->summarize->tick), native-apply
  verb = thin effector (runs kernel in VM, reads computed result, emits effect).
- integration test os_kernels_live_in_cube_with_call_graph_and_descriptors.

Proven green via ./check quick (fmt+clippy -D warnings+tests).

cubesys/src/store.rs

@@ -691,9 +691,10 @@ impl ConcurrentStore {
         links: &[Czyx],
         code: &[Op],
         owner: Option<&str>,
+        descriptor: Option<cubecode::Behavior>,
     ) -> Result<Czyx, crate::SysError> {
         let coord = self.with_mut(|store| {
-            crate::store_code_cell(store, path, kind, name, links, code, owner)
+            crate::store_code_cell(store, path, kind, name, links, code, owner, descriptor)
         })?;
         if let Some(v) = self.get_raw(&coord) {
             self.log_put(coord, v);