feat: ACPI Wave 1 boot-critical hardening (P19) + robust patch generation

- P19-init-startup-hardening: Replace panic-grade expect/unwrap in init
  startup paths (getns, register_scheme_to_ns, setrens, filename parsing)
  with graceful error handling and logging
- P19-acpid-startup-hardening: Replace panic-grade calls in acpid with
  graceful degradation (rxsdt read failure → warn + exit 0, SDT parse →
  error + exit 1, I/O privilege → fatal, scheme registration → fatal,
  setrens → warn + continue, event loop errors → log + continue)
- P18-9-msi-allocation-resilience: Regenerate with git diff -U0 -w format
  for maximum context resilience
- fetch.rs: Change --fuzz=0 to --fuzz=3 for resilient patch application
- AGENTS.md: Document robust patch generation technique as mandatory
- Add P4/P5/P6/P7 patches (estale, dmi, i2c, ps2d hardening)
- Add P21 kernel x2apic SMP fix patch
- Multiple local recipe source improvements (redox-drm, driver-manager,
  driver-acpi, thermald)
- Config updates for redbear-mini and redbear-device-services
- Subsystem assessment document

src/cook/fetch.rs

@@ -1266,7 +1266,7 @@ pub(crate) fn fetch_apply_patches(
             command.arg("--directory").arg(&staging_dir);
             command.arg("--strip=1");
             command.arg("--batch");
-            command.arg("--fuzz=0");
+            command.arg("--fuzz=3");
             command.arg("--no-backup-if-mismatch");
             run_command_stdin(command, patch_data.as_slice(), logger)
                 .map_err(|e| format!("patch {patch_name} FAILED: {e}"))?;
@@ -1439,7 +1439,7 @@ pub fn validate_patches(recipe: &CookRecipe, logger: &PtyOut) -> Result<()> {
         command.arg("--directory").arg(&staging_dir);
         command.arg("--strip=1");
         command.arg("--batch");
-        command.arg("--fuzz=0");
+        command.arg("--fuzz=3");
         command.arg("--no-backup-if-mismatch");
 
         match run_command_stdin(command, patch_data.as_slice(), logger) {