CUBELinux-2
0074f3112c
cb.rs previously implemented only 3 of the 6 spec descriptors (pure/io/hot). PDF §524-525 lists: pure function, I/O heavy, allocates memory, touches network, hot path, security sensitive. - Behavior now stores descriptor bits directly as dedicated header-flag bits in the spare 8..=15 range: PURE=9, IO_HEAVY=10, ALLOCATES=11, NETWORK=13, HOT_PATH=14, SECURITY_SENSITIVE=15. Bit 12 (ENCRYPTED) left clear; mask 0xEE00. refresh_flags() preserves 8..=15 so round-trip is safe. - K= CLI tokens gain alloc/net/sec (prog + kernel verbs). - Add unit test for all-six round-trip + explicit security-sensitive bit. Proven green via ./check quick.