security: A07 complete, Round 3.1 initrd/LZ4/TAR validation (A05)

security: A07 complete, Round 3.1 initrd/LZ4/TAR validation (A05)

- A07: vfs_check_permission moved to fs.c, vfs_check_parent_permission now validates real permissions
- A05: initrd parser validation:
  - Minimum size checks for magic (4 bytes), LZ4 frame header (10 bytes), LZ4B header (12 bytes)
  - Update size variable after decompression to reflect decompressed size
  - TAR file size limit (256MB max)
  - Removed overly strict buffer overflow check that rejected valid TAR

Tests: 119/119 PASS (smoke test, SMP=4)