CUBELinux.0.4: the kernel folds its own log

Until now the kernel could append to a log but needed a *userspace* checkpoint to
reclaim it — the dependency the write-authority decision was meant to remove.
This is the fold.

A store device is no longer an image at offset 0. It is:

  [control copy A][control copy B][slot 0][slot 1][log]

with the control block saying which slot is live and how much log is in use, and
two copies each carrying a generation and a checksum. Two slots buy atomicity:
the folded image is written to the slot nothing is reading and flushed, and only
then does the control change — one small write to the copy that is *not* current.
At every instant there is either the old image with a log that still describes the
mutations since it, or the new image with an empty log. A crash in the middle of
the copy leaves the previous store intact, which is the entire reason for two
slots. Folding into the only copy of an image is not atomic, so `sync` refuses on
a bare image rather than pretending.

`sync` is a real operation, not a test hook: a caller that wants the log reclaimed
— a shutdown, a snapshot, a handover — is entitled to ask.

Gate (kernel/verify-kernel-checkpoint.sh): the kernel writes four mutations and
then folds its own log. The image it writes is compared with the one userspace
writes from the same mutations byte for byte, not by digest — and it is identical,
with the log empty afterwards.

Three bugs came out of building this, all caught by the gates rather than by
inspection:

- the refactor that extracted the merge left the image walk *duplicated* inside
  the digest, re-adding image records after the log's entries — which gave them a
  newer sequence number and quietly resurrected records the log had deleted;
- a v1 image has no extent, so it has no log either, and the new layout code was
  demanding both;
- an unwritten log region is empty, not broken, and the first append was refusing
  it. The append gate's harness was also counting a *refused* write as accepted,
  which is how the second one hid.

All six gates pass: three image reads (v1 curated, v1 snapshot at 35,318 records,
v2 store), the log replay, the append with its SIGKILL durability test, and the
checkpoint compared byte for byte.

Makefile

@@ -9,7 +9,7 @@ NAME = CUBELinux
 # release. The base version stays in VERSION/PATCHLEVEL/SUBLEVEL above (visible in
 # `make kernelversion`), while `uname -r` and /lib/modules report the CUBELinux
 # release, with any -dirty or SCM suffix still appended by setlocalversion.
-CUBELINUX_VERSION = CUBELinux.0.3
+CUBELINUX_VERSION = CUBELinux.0.4
 
 # *DOCUMENTATION*
 # To see a list of typical targets execute "make help"