feat: build system transition to release fork + archive hardening

Release fork infrastructure:
- REDBEAR_RELEASE=0.1.1 with offline enforcement (fetch/distclean/unfetch blocked)
- 195 BLAKE3-verified source archives in standard format
- Atomic provisioning via provision-release.sh (staging + .complete sentry)
- 5-phase improvement plan: restore format auto-detection, source tree
  validation (validate-source-trees.py), archive-map.json, REPO_BINARY fallback

Archive normalization:
- Removed 87 duplicate/unversioned archives from shared pool
- Regenerated all archives in consistent format with source/ + recipe.toml
- BLAKE3SUMS and manifest.json generated from stable tarball set

Patch management:
- verify-patches.sh: pre-sync dry-run report (OK/REVERSED/CONFLICT)
- 121 upstream-absorbed patches moved to absorbed/ directories
- 43 active patches verified clean against rebased sources
- Stress test: base updated to upstream HEAD, relibc reset and patched

Compilation fixes:
- relibc: Vec imports in redox-rt (proc.rs, lib.rs, sys.rs)
- relibc: unsafe from_raw_parts in mod.rs (2024 edition)
- fetch.rs: rev comparison handles short/full hash prefixes
- kibi recipe: corrected rev mismatch

New scripts: restore-sources.sh, provision-release.sh, verify-sources-archived.sh,
check-upstream-releases.sh, validate-source-trees.py, verify-patches.sh,
repair-archive-format.sh, generate-manifest.py

Documentation: AGENTS.md, README.md, local/AGENTS.md updated for release fork model

CONTRIBUTING.md

@@ -76,12 +76,12 @@ You can read the best practices and guidelines on the [Best practices and guidel
 
 ## Repository Model for Contributors
 
-RedBearOS should be treated as an overlay distribution on top of Redox, in the same way Ubuntu
+RedBearOS should be treated as an full fork on top of Redox, in the same way Ubuntu
 relates to Debian.
 
 That means contributors should keep this separation in mind:
 
-- upstream-owned trees such as `recipes/*/source/` are refreshable working copies,
+- upstream-owned trees such as `recipes/*/source/` are immutable archived release snapshot,
 - durable Red Bear-specific work belongs in `local/patches/`, `local/recipes/`, `local/docs/`, and
   tracked Red Bear configs,
 - if a change exists only in an upstream-owned source tree, it is not yet preserved properly for
@@ -95,7 +95,7 @@ upstream promotes it to first-class status.
 So for contributors:
 
 - upstream WIP may still be a useful input/reference,
-- but fixes intended for Red Bear shipping should normally land in the Red Bear overlay,
+- but fixes intended for Red Bear shipping should normally land in the Red Bear release fork,
 - and when upstream later catches up, Red Bear should prefer upstream and retire local patches or
   local recipe copies that are no longer needed.
 
@@ -129,7 +129,7 @@ Since **Rust** is a relatively small and new language compared to others like C
 
 Please follow our [Git style](https://doc.redox-os.org/book/creating-proper-pull-requests.html) for pull requests.
 
-For user-visible work, keep the root [`CHANGELOG.md`](CHANGELOG.md) current and refresh the
+For user-visible work, keep the root [`CHANGELOG.md`](CHANGELOG.md) current and immutable archived the
 README "What's New" section with the latest highlights so GitHub visitors can immediately see what
 changed.