init: a hang is as detectable as a death, and PID 1 comes back

docs/plan/init.md milestones I2 and I3. The rule change.

**I2 -- the heartbeat.** The failure the two-init scheme could not see is that
an init usually does not die, it *hangs*: wait() never returns for a process
that is merely stuck, so a supervisor watching a wedged init reports
everything normal for ever. PID 1 now pings every two seconds and expects an
answer within ten; silence means stuck, and stuck is worth acting on.

Exercised rather than reasoned about, as the plan asks: `sysrq w` wedges
schinitd by making the scheduler pass over it for ever. It stays alive, keeps
its descriptors and appears in every listing -- which is the point.

Two things that only showed up by running it:

  - kill() sets a flag the target checks when it next runs, and the premise
    here is that it is not running. Waiting for a corpse that may never be
    produced turns the recovery path into a second hang. PID 1 replaces the
    supervisor *without waiting*; the old one's socket is closed, so the moment
    it runs again its first write fails and it exits.
  - the replaced supervisor must notice the hangup. poll() reports POLLHUP and
    never POLLIN again, so a loop that only looks for POLLIN sits there
    complaining that PID 1 has stopped pinging it.

**I3 -- proc_reincarnate().** exit() on initproc panicked. Now the kernel
tears down nothing, keeps pid 1, and re-execs /bin/schinit in place with a
generation counter. The pid stays 1, so every orphan the kernel reparented is
still correctly parented; the children survive; the open files survive, which
is why this is the first line of exit() and not the last; and the job table
survives in /proc/schinit, which is what it is there for.

The escalation ladder: generations 2-3 carry on, generation 4 ignores
/etc/schinit and starts a console shell only -- a manifest that kills init
must not kill it for ever -- and generation 5 stops, with PSOGM rendering
INIT_RESURRECTION_FAILED, a call chain and a QR code.

Three bugs found by running it, each a lesson about exec():

  - exec() returns 0 on success; it does not fail to return. The new image
    starts when the kernel returns to userspace through the rewritten
    trapframe. Returning from exit() is the success path.
  - exit() was reached because `killed` was set, and the trap path checks it
    again on the way out. Leaving it set exits the new image before its first
    instruction: five generations in a few microseconds, a resurrection loop
    that looks exactly like the crash it was meant to survive.
  - exec() keeps open files, which is what gives the new image a console --
    and also keeps the previous life's socket, holding the old supervisor's
    channel up so it never sees a hangup.

Verified: `sysrq i`, and the shell being typed into keeps its pid across the
death and rebirth of PID 1, with /proc/schinit byte-identical either side.

schfs-check passes.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VQ7Qx8E1q1M1bbCq8QLHS2

kernel/dev/procfs.c

@@ -488,10 +488,37 @@ proc_sysrq_cmd(char cmd)
   case 't':
     text_selftest();
     break;
+  case 'i':
+    // Kill PID 1, on purpose.
+    //
+    // Signals cannot do this -- init_ignores() drops them, which is correct
+    // and is why the two-init scheme was solving a problem that did not exist.
+    // Setting `killed` directly is the kernel deciding, not userspace asking:
+    // init exits at its next trap return and proc_reincarnate() takes over.
+    //
+    // docs/plan/init.md asks for this to be "tested by a sysrq key rather than
+    // by reasoning", which is the only honest way to know the path works.
+    proc_kill_init();
+    cprintf("sysrq: pid 1 asked to exit -- it should come back\n");
+    break;
+
+  case 'w': {
+    // Wedge the supervisor: make schinitd hang, on purpose, so PID 1's
+    // heartbeat timeout is exercised instead of reasoned about. There is no
+    // way back from this; reboot afterwards.
+    int pid = proc_wedge("schinitd");
+    if (pid)
+      cprintf("sysrq: wedged schinitd (pid %d) -- pid 1 should notice "
+              "within %d seconds\n", pid, 10);
+    else
+      cprintf("sysrq: no process named schinitd to wedge\n");
+    break;
+  }
   default:
     cprintf("sysrq: unknown command '%c' "
             "(known: c = crash, u = dump USB, s = read the USB disk, "
-            "d = display self-test)\n",
+            "d = display self-test, t = text self-test, n = net self-test, "
+            "w = wedge the init supervisor, i = kill pid 1)\n",
             cmd);
     break;
   }