feat: ACPI Wave 1 boot-critical hardening (P19) + robust patch generation

- P19-init-startup-hardening: Replace panic-grade expect/unwrap in init
  startup paths (getns, register_scheme_to_ns, setrens, filename parsing)
  with graceful error handling and logging
- P19-acpid-startup-hardening: Replace panic-grade calls in acpid with
  graceful degradation (rxsdt read failure → warn + exit 0, SDT parse →
  error + exit 1, I/O privilege → fatal, scheme registration → fatal,
  setrens → warn + continue, event loop errors → log + continue)
- P18-9-msi-allocation-resilience: Regenerate with git diff -U0 -w format
  for maximum context resilience
- fetch.rs: Change --fuzz=0 to --fuzz=3 for resilient patch application
- AGENTS.md: Document robust patch generation technique as mandatory
- Add P4/P5/P6/P7 patches (estale, dmi, i2c, ps2d hardening)
- Add P21 kernel x2apic SMP fix patch
- Multiple local recipe source improvements (redox-drm, driver-manager,
  driver-acpi, thermald)
- Config updates for redbear-mini and redbear-device-services
- Subsystem assessment document

recipes/core/kernel/recipe.toml

@@ -34,6 +34,11 @@ patches = [
     "../../../local/patches/kernel/P17-3-sched-affinity.patch",
     "../../../local/patches/kernel/P17-3-syscall-dispatch.patch",
     "../../../local/patches/kernel/P19-2-irq-debug.patch",
+    # P20: x2APIC ICR mode fix (32-bit dest field for x2APIC, 8-bit for xAPIC)
+    "../../../local/patches/kernel/P20-x2apic-icr-mode-fix.patch",
+    # P21: x2APIC SMP bring-up fix — skip 8-bit LocalApic entries when x2APIC
+    # is active (BSP ID mismatch causes all APs to be skipped on bare metal Intel)
+    "../../../local/patches/kernel/P21-x2apic-smp-fix.patch",
 ]
 
 [build]