review-fixes: address 5-lane review blocking findings

The 5-lane review of the 3 implementation commits uncovered
several actionable items in the scope of those commits. This
follow-up fixes the critical ones.

1. guard-recipes.sh --restore: add parent-symlink guard
   The --restore mode was missing the parent-symlink guard that
   --fix mode has. Without it, a recipe whose parent directory is
   a symlink into local/recipes/ could be deleted from disk during
   restore (the file symlink resolves through the dir symlink, so
   the subsequent rm -f deletes the real local file). This was a
   CRITICAL data-loss vector.

2. dbus-root-uid.patch symlink: restore
   The commit e65a23fd6b deleted this symlink as 'orphan cleanup'
   but recipe.toml still references it in its patches list.
   Without the symlink, the next clean fetch of the dbus recipe
   would fail with 'Failed to find patch file'. Restored.

3. wifictl dbus-nm feature: enable by default
   The 656-line NM interface implementation was feature-gated
   behind dbus-nm with default = [], making it dead code at
   build time. This violates the zero-stubs policy (no
   feature-gated no-ops). Changed default to ['dbus-nm'] so
   the interface is actually wired in the built binary.

4. redbear-sessiond power operations: propagate write_all errors
   power_off/reboot/suspend were discarding write_all results
   with 'let _ = ...'. A successful open followed by a failed
   write was reported to the caller as success. Now the write
   result is checked and reported as a D-Bus error, with
   preparing_for_shutdown/sleep reset to false on failure.

5. redbear-notifications capabilities: stop advertising unimplemented features
   The capabilities list advertised 'actions' and 'persistence'
   but the implementation has no graphical UI for action rendering
   and does not persist notifications across daemon restarts.
   Honest capabilities now: ['body', 'body-markup']. Also
   sanitized notification body logging (no body, app_name, or
   summary in stderr to avoid data exposure); updated server
   information version string from 0.3.0 to 0.3.1 to match
   the actual source Cargo.toml.

6. verify-fork-functions.sh: narrow blanket exclusion
   The blanket exemption covered drop, deref, hash, clone,
   and other methods that can carry custom semantics. The
   exemption now covers only fmt and eq (derivable, no semantic
   cost). All other trait methods must go through the
   fork-specific .verify-fork-functions.exclude file.

Out of scope (pre-existing, not from the reviewed commits):
- sessiond 'can_methods_return_na' test failure on Linux host
  (caused by kstop_writable() probe added in later commit a9e1c34e27)
- wifictl backend.rs compilation corruption from later commit
  222d5186eb ('add minimal # Safety comments to 70 files'
  split perms.set_mode(0o755); mid-token)
- AI co-author attribution in submodule/base commit ec7670ef
  (cannot rewrite history per AGENTS.md no-force-push rule)

local/recipes/system/dbus/dbus-root-uid.patch

@@ -0,0 +1 @@
+../../../../local/patches/dbus/dbus-root-uid.patch