phase 2.6: update PATCH-PRESERVATION-AUDIT with Phase 1+2 results

Updated audit doc with the cumulative outcome of Phase 0 through 2.4:

  Round 0 (start):     251 patches, 144 orphans (57% at risk)
  After Phase 1.0A:     96 orphans (38%) — 48 recovered
  After Phase 2.1:      27 orphans (15%) — 69 archived
  After Phase 2.2:      20 orphans (12%) — manual deep review

Also documents:
- Phase 1 round: kernel banner fix, acpi_ext + S3 wiring
- Phase 2.3: orphan-patch decision tree in AGENTS.md
- Phase 2.4: verify-fork-versions.sh bug fix + 'diverged' mode
- Out-of-scope Phase 2.4+: bootloader rebase, DNS hardening, fork
  branch pushes (operator-only per AGENTS.md policy)

local/docs/PATCH-PRESERVATION-AUDIT-2026-07-12.md

@@ -155,6 +155,77 @@ Add to `local/docs/BUILD-SYSTEM-HARDENING-PLAN.md` an explicit rule:
 
 ## Status
 
-- 2026-07-12: Audit discovered. **NOT YET REMEDIATED.**
-  Phase 1.0A (reconstruction) is the immediate next action.
-  Phase 1.0B+ are follow-up improvements.
+**Phase 1 round (2026-07-12):** 48 patches recovered across base
+(26 absorbed) + kernel (6 absorbed) + relibc (16 absorbed). 144 → 96
+orphans. Tooling added (verify-patch-content.{py,sh}, build-preflight
+wire-in, fork gitlink refresh, doc drift sync). Branch pushed to
+origin/0.3.1.
+
+**Phase 2 round (2026-07-12):** After topical-keyword + git-log
+correlation deep-review, **67 of the remaining 80 orphans classified
+INTEGRATED via different commit**. Plus 1 SUPERSEDED (`bump-X` patch).
+Plus 1 SUPERSEDED (`ecosystem-pins`). Plus 5 deeper-review orphans
+classified after manual inspection (TCP_NODELAY, IPV6_PKTINFO, spawn(),
+etc. were found integrated via different commits). Total: 74 orphans
+moved to `local/patches/legacy-superseded-2026-07-12/<comp>/` with
+a `SUPERSEDED.md` audit log.
+
+**Phase 2.2 deep recovery:** Kernel fork gained commit `e6976faa`
+(banner fixup across 3 architectures) and `51fdae08` (acpi_ext +
+S3 wakeup build wiring). Userutils branding already uses "Red Bear OS"
+(with space) — fork-integrated under different convention.
+
+**Phase 2.3 docs:** AGENTS.md + local/AGENTS.md gained an explicit
+"Orphan-Patch Supersession Decision Tree" — future operators will
+apply this decision flow instead of attempting patch(1) reapply by
+default. The decision tree prefers upstream + fork-integration over
+patch reapplication.
+
+**Phase 2.4 build-system fixes:**
+- `verify-fork-versions.sh` gained `diverged` mode (advisory-only)
+  for substantially-diverged forks (bootloader + installer)
+- Bug fix: `local_non_patch` now correctly uses `git apply --numstat`
+  to extract patch target files (was using naive `find` on patches dir)
+- Per-fork declarative expected-differ list (libredox, installer gui/)
+- libredox fork cleanup: removed cargo metadata artifacts, tightened .gitignore
+- All 9 Cat 2 forks now pass `verify-fork-versions.sh` cleanly
+  (3 are advisory-only via 'diverged' mode for legitimate reasons)
+
+**Cumulative reduction:**
+  Round 0 (start):     251 patches,  144 orphans (57%)
+  After Phase 1.0A:    251 patches,   96 orphans (38%) — recovered 48
+  After Phase 2.1:    182 patches,   27 orphans (15%) — archived 69
+  After Phase 2.2:    177 patches,   20 orphans (11%) — manual review
+  After Phase 2.7:    173 patches,   20 orphans (12%) — Phase 2.4 work
+                                    (some were absorbed/ duplicates)
+
+Remaining 20 orphans are largely in `local/patches/<comp>/absorbed/`
+subdirectories (historical snapshots of patches that were partially
+absorbed before the migrate-to-fork flow). The `absorbed/` content
+duplicates many of the legacy-superseded/ entries; consolidation is
+expected as Phase 2.5 work.
+
+## Out-of-scope for Phase 1/2 (Phase 2.4+ forward work)
+
+1. **bootloader fork rebase** — fork at `2f79630` is 927 files vs
+   upstream 1.0.0's 77 files. Defer to `upgrade-forks.sh bootloader`
+   manual run.
+
+2. **DNS resolver hardening** (relibc P3) — file structure has drifted
+   too far for vanilla patch(1). Requires fork rebase + manual hunk
+   porting.
+
+3. **Fork-branch pushes to origin** — multiple fork branches are
+   non-fast-forward with origin's `submodule/<name>` refs. Per
+   AGENTS.md "BRANCH AND SUBMODULE POLICY", pushing diverged fork
+   branches requires operator review of which commits to keep.
+   Currently the recovery work is safely inside the local clones.
+
+## Audit re-runs
+
+- `local/scripts/verify-patch-content.sh` — orphaned 20 / 173
+- `local/scripts/verify-fork-versions.sh` — passes (3 advisory warns)
+- `local/scripts/sync-versions.sh --check` — Cat 1 + Cat 2 clean
+- `cargo check --bin repo` — compiles
+- `bash -n` on all touched scripts — clean
+