node-service-manager: the kernel-log verb beside journal (issue 1975)

The kernel's messages of this boot or an earlier one (boot 0, -1, ...), in a window, narrowed to a
priority and a text, at most 2000 lines, the journal's argument forms; replaces journalctl -k,
journalctl -k -b -1 and dmesg. seatgen -check is clean.

Builds: issue 1975, the operator's request of 2026-11-12 (the lead's handover; no design line names the verb)

Claude-Session: https://claude.ai/code/session_01NcbgfGKaxw984XyAPfLm4h

seats/node-service-manager/seat.json

@@ -208,6 +208,44 @@
         "type": "object"
       }
     },
+    {
+      "name": "kernel-log",
+      "description": "The kernel's messages (what journalctl -k gives) of this boot or an earlier one, at most 2000 lines, in a time window and narrowed to a priority and to lines holding a text when asked. A secret a line held is shown as [redacted: \u003cwhat it was\u003e].",
+      "replaces": [
+        "journalctl -k",
+        "journalctl -k -b -1",
+        "dmesg"
+      ],
+      "input": {
+        "properties": {
+          "boot": {
+            "description": "which boot: 0 this boot (the default), -1 the one before, -2 the one before that, and so on (optional)",
+            "type": "string"
+          },
+          "lines": {
+            "description": "how many lines from the end of what matches (default 100, at most 2000)",
+            "type": "string"
+          },
+          "match": {
+            "description": "only the lines holding this text, as written — a fixed string, not a pattern (optional)",
+            "type": "string"
+          },
+          "priority": {
+            "description": "only entries this severe or more: 0-7 or emerg, alert, crit, err, warning, notice, info, debug (optional)",
+            "type": "string"
+          },
+          "since": {
+            "description": "the window's start: an RFC 3339 time (2026-10-07T09:30:00Z) or relative to now (-30min, -2h, yesterday) (optional)",
+            "type": "string"
+          },
+          "until": {
+            "description": "the window's end, in the same forms (optional; now when absent)",
+            "type": "string"
+          }
+        },
+        "type": "object"
+      }
+    },
     {
       "name": "failed",
       "description": "Every failed unit on this machine, in the system manager and in the operator account's; a manager that does not answer is reported with its error, never as nothing failed.",