build: cancel -fhardened; fix termcap for GCC 16; regenerate pam-redbear lock

Three GCC 16 gaps found by the redbear-full build.

-fhardened (seatd and other meson recipes, 24 errors)
  -fhardened is a host-glibc hardening bundle x86_64-unknown-redox cannot
  implement, but GCC accepts it on the command line, so meson's
  cc.has_argument('-fhardened') probe answers YES and meson adds it to
  every compile. GCC then refuses it for real:
    cc1: error: '-fhardened' not supported for this target [-Werror]
  Note the tag is [-Werror], not [-Werror=hardened] -- it is an
  unconditional warning, so -Wno-hardened does not silence it (tried, and
  it did not). The flag has to be cancelled instead; -fno-hardened does
  that cleanly and the cookbook's flags are appended after the project's
  own, so it wins. Nothing is weakened: the compiler is telling us the
  option is inert on this target.

termcap (two independent defects, both latent until now)
  1. Makefile.in hardcoded 'CFLAGS = -g' and has no @CFLAGS@ substitution
     at all, so nothing configure resolved ever reached the compiler --
     including the toolchain's default C dialect. termcap is pre-ANSI
     code, so being compiled as GCC 16's default C23 failed at once with
     'too many arguments to function malloc; expected 0, have 1'.
     Substituting @CFLAGS@ is what a normal autotools Makefile.in does.
  2. With CFLAGS flowing, the remaining errors were implicit declarations
     of strlen/memcpy/exit/write, which GCC 14+ makes errors regardless of
     -std. Cause: autoconf 2.70+ removed AC_HEADER_STDC, so STDC_HEADERS
     is never defined and termcap.c/tparam.c took their pre-ANSI branch,
     declaring 'char *malloc ();' instead of including <stdlib.h>.
     Autoconf's guidance on dropping AC_HEADER_STDC is to assume those
     headers exist, which holds for every target Red Bear builds.

pam-redbear
  Cargo.lock missed by the earlier sweep; regenerated for the 0.3.2 fork
  versions.

termcap and seatd now cook clean.

src/cook/script.rs

@@ -136,6 +136,23 @@ export CPPFLAGS="${CPPFLAGS:+$CPPFLAGS }-I${COOKBOOK_SYSROOT}/include"
 # (std::ranges::to), which is the reason for the GCC 16 upgrade.
 export CFLAGS="${CFLAGS:+$CFLAGS }-std=gnu17"
 
+# -fhardened is a host-glibc hardening bundle that x86_64-unknown-redox
+# cannot implement. GCC still *accepts* the flag on the command line, so a
+# meson project's cc.has_argument('-fhardened') probe answers YES and meson
+# adds it to every compile; GCC then refuses it for real:
+#     cc1: error: '-fhardened' not supported for this target [-Werror]
+# and the project's -Werror makes it fatal. seatd died on this 24 times.
+#
+# Note the diagnostic is tagged [-Werror], not [-Werror=hardened]: it is an
+# unconditional warning, so -Wno-hardened does NOT silence it (verified).
+# The flag itself has to be cancelled, and -fno-hardened does that cleanly.
+# The cookbook's flags are appended after the project's own, so this wins.
+#
+# This does not weaken anything: -fhardened is inert on this target by
+# construction — the compiler is telling us it cannot honour it.
+export CFLAGS="${CFLAGS} -fno-hardened"
+export CXXFLAGS="${CXXFLAGS:+$CXXFLAGS }-fno-hardened"
+
 # This adds the sysroot libraries and compiles binaries statically for most C compilation
 #TODO: check paths for spaces!
 USER_LDFLAGS="${LDFLAGS:+$LDFLAGS }"