feat: implement kernel capability model

kernel/src/Fs/ProtectedPaths.hpp

@@ -0,0 +1,20 @@
+/*
+    * ProtectedPaths.hpp
+    * Capability required to modify paths on the booted system volume
+    * Copyright (c) 2026 Daniel Hammer
+*/
+
+#pragma once
+#include <cstdint>
+
+namespace Fs {
+
+    // Capability a process must hold to create, write, delete, rename or
+    // re-timestamp `path`. Returns 0 when the path is unprotected.
+    uint64_t RequiredFileWriteCapability(const char* path);
+
+    // Log the rule table at boot, so a path that should be protected and is
+    // not is visible rather than silently missing.
+    void LogProtectedPaths();
+
+}