Record and expose how every process ends (M17.2)

The kernel records an ExitReason at all three death sites — clean exit,
fault (classified by vector), and process_kill — into a bounded ring
before the exit notification posts, so a supervisor's query never races
the notice. process_exit_reason is gated by the same supervisor check as
kill; runtime.process.exitReason is the stable interface. This is the
input restart policy reads (docs/process-lifecycle.md iron rule 2).

docs/process-lifecycle.md

@@ -245,13 +245,16 @@ pub fn stop(id: u32, deadline_ms: u64) void { ... }
 /// process_enumerate.
 pub fn subscribeExits(endpoint: usize) bool { ... }
 
-/// How a process ended — from the exit notification. What restart policy reads.
-pub const ExitReason = enum {
+/// How a process ended — queried after the exit notification (the kernel records
+/// it first, so the two never race). What restart policy reads. (Built in M17.2.)
+pub const ExitReason = enum(u8) {
     exited, // returned from main / clean exit
-    aborted, // abort() — deliberate self-termination (SIGABRT's ghost)
+    aborted, // abort() — deliberate self-termination (SIGABRT's ghost; reserved)
     segmentation_fault, // SIGSEGV's ghost
     illegal_instruction, // SIGILL's ghost
     arithmetic_fault, // SIGFPE's ghost
+    protection_fault, // general protection fault
+    fault, // any other CPU exception
     killed, // process_kill
 };
 ```