Trust model docs + privops authorize-before-dispatch (1.1.11)

[click0]

Summary

Two related changes on top of main (1.1.11):

1. Trust-model docs (docs/trust-model.{md,uk.md})

Document where cross-tenant isolation is enforced and where it is not, accurate to the rootless model: the privileged plane is no longer setuid crate(1) (removed in 1.0.0) — it relocated into crated's privops surface (HTTP admin-only + libnv group-gated socket). Per-tenant isolation is enforced on the pooled control plane (control sockets / bearer tokens / ws-console); local Unix access to the main API stays a single trust domain. Per-user namespacing separates honest operators but isn't an adversarial boundary on the privops path. Cross-links security-command-paths.{md,uk.md}.

2. privops authorize-before-dispatch (feat)

Closes the cleanly-ownable part of the gap the doc identified. New pure module lib/privops_authz_pure.{h,cpp} + privops_authz_pure_test (12 cases). On the libnv transport (real peer uid via getpeereid), when rootless per-user is on, a verb is denied 403 before dispatch if it names another operator's resource:

• attach_zfs / detach_zfs — dataset must lie within the caller's per-user ZFS prefix <master>/<uid>;
• set_loginclass_rctl / clear_loginclass_rctl — loginclass must be the caller's crate-<uid>.

Wired into dispatchPrivOpFromMap only; the HTTP/admin path (uid==0) is unchanged and host-wide by design. Per-user config registered at startup via setPerUserAuthzConfig (mirrors setUmbrellaConfig).

Deliberately deferred (documented in the doc as the remaining gap):

• host-global verbs (iface / pf / ipfw / nat / epair) — cannot be pool-scoped; host-wide by design;
• jid-scoped verbs (set_rctl, signal_jail, create_jail, set_jail_cpuset, devfs, …) — no request-borne owner; need a jid→owner registry (record operator uid at create_jail, check on each jid-keyed verb). Not in this PR.

Verification

• make test-unit (kyua + libatf) locally on Linux: 1329/1329 passed, incl. the 12 new privops_authz_pure_test cases.
• The daemon wiring (privops_handlers.cpp, main.cpp) compiles on FreeBSD only (libnv); it uses portable facilities and the existing setUmbrellaConfig pattern. Please confirm FreeBSD CI is green.

Heads-up for reviewers

• Is the HTTP privops path intended to stay host-wide admin (it does here), or should it eventually carry pool/uid too?
• The jid→owner registry is the natural follow-up to gate the jid-scoped verbs — happy to do it as a separate PR if you want it.

Test plan

• FreeBSD CI green (daemon build + kyua).
• Confirm the dataset/loginclass ownership semantics match intent.
• Decide whether the jid→owner registry follow-up is wanted.

https://claude.ai/code/session_01X6t6tzVypHye5bDGLxzmZK