fix: comprehensive boot warnings and exceptions — fixable silenced, unfixable diagnosed

Build system (5 gaps hardened):
- COOKBOOK_OFFLINE defaults to true (fork-mode)
- normalize_patch handles diff -ruN format
- New 'repo validate-patches' command (25/25 relibc patches)
- 14 patched Qt/Wayland/display recipes added to protected list
- relibc archive regenerated with current patch chain

Boot fixes (fixable):
- Full ISO EFI partition: 16 MiB → 1 MiB (matches mini, BIOS hardcoded 2 MiB offset)
- D-Bus system bus: absolute /usr/bin/dbus-daemon path (was skipped)
- redbear-sessiond: absolute /usr/bin/redbear-sessiond path (was skipped)
- daemon framework: silenced spurious INIT_NOTIFY warnings for oneshot_async services (P0-daemon-silence-init-notify.patch)
- udev-shim: demoted INIT_NOTIFY warning to INFO (expected for oneshot_async)
- relibc: comprehensive named semaphores (sem_open/close/unlink) replacing upstream todo!() stubs
- greeterd: Wayland socket timeout 15s → 30s (compositor DRM wait)
- greeter-ui: built and linked (header guard unification, sem_compat stubs removed)
- mc: un-ignored in both configs, fixed glib/libiconv/pcre2 transitive deps
- greeter config: removed stale keymapd dependency from display/greeter services
- prefix toolchain: relibc headers synced, _RELIBC_STDLIB_H guard unified

Unfixable (diagnosed, upstream):
- i2c-hidd: abort on no-I2C-hardware (QEMU) — process::exit → relibc abort
- kded6/greeter-ui: page fault 0x8 — Qt library null deref
- Thread panics fd != -1 — Rust std library on Redox
- DHCP timeout / eth0 MAC — QEMU user-mode networking
- hwrngd/thermald — no hardware RNG/thermal in VM
- live preload allocation — BIOS memory fragmentation, continues on demand

local/recipes/system/dbus/source.tmp/tools/docker/windows/Dockerfile

@@ -0,0 +1,65 @@
+# escape=`
+
+FROM 'mcr.microsoft.com/windows/servercore:ltsc2022'
+
+# Make sure any failure in PowerShell scripts is fatal
+SHELL ["powershell", "-Command", "$ErrorActionPreference = 'Stop';"]
+ENV ErrorActionPreference='Stop'
+
+# Install Chocolatey
+RUN iex ((New-Object System.Net.WebClient).DownloadString('https://chocolatey.org/install.ps1'))
+# Install required packages
+RUN choco install -y vcredist140
+RUN choco install -y cmake --installargs 'ADD_CMAKE_TO_PATH=System'
+RUN choco install -y git --params '/NoAutoCrlf /NoCredentialManager /NoShellHereIntegration /NoGuiHereIntegration /NoShellIntegration'
+RUN choco install -y windows-sdk-8.1
+RUN choco install -y python3
+RUN choco install -y msys2 --params '/NoPath /NoUpdate /InstallDir:C:\\msys64'
+
+RUN 'git config --global user.email "cirunner@dbus.freedesktop.org"; git config --global user.name "D-Bus CI system"'
+
+RUN pip3 install meson
+# FIXME: Python fails to validate SSL certificates, for unclear reasons
+# try various ways to update the store, certifi-win32 seems to work as long as we fetch before
+# See also: https://bugs.python.org/issue36011
+RUN pip3 install --upgrade certifi
+RUN pip3 install python-certifi-win32
+RUN (New-Object System.Net.WebClient).DownloadString('https://sourceforge.net/projects/pcre/files/pcre/8.37/pcre-8.37.tar.gz.sig') >$null
+RUN (New-Object System.Net.WebClient).DownloadString('https://wrapdb.mesonbuild.com/v2/pcre_8.37-2/get_patch') >$null
+RUN (New-Object System.Net.WebClient).DownloadString('https://zlib.net/fossils/') >$null
+
+# MinGW environment
+RUN c:\msys64\usr\bin\bash -lc 'pacman -S --noconfirm mingw-w64-ucrt-x86_64-toolchain expat glib2-devel ninja'
+
+# Visual Studio can't be installed with choco.
+# It depends on dotnetfx v4.8.0.20190930, which requires a reboot: dotnetfx (exit code 3010)
+# https://github.com/microsoft/vs-dockerfiles/blob/main/native-desktop/
+# Set up environment to collect install errors.
+COPY Install.cmd C:\TEMP\
+ADD https://aka.ms/vscollect.exe C:\TEMP\collect.exe
+# Download channel for fixed install.
+ARG CHANNEL_URL=https://aka.ms/vs/15/release/channel
+ADD ${CHANNEL_URL} C:\TEMP\VisualStudio.chman
+# Download and install Build Tools for Visual Studio 2017 for native desktop workload.
+ADD https://aka.ms/vs/15/release/vs_buildtools.exe C:\TEMP\vs_buildtools.exe
+RUN C:\TEMP\Install.cmd C:\TEMP\vs_buildtools.exe --quiet --wait --norestart --nocache `
+    --channelUri C:\TEMP\VisualStudio.chman `
+    --installChannelUri C:\TEMP\VisualStudio.chman `
+    --add Microsoft.VisualStudio.Workload.VCTools --includeRecommended`
+    --installPath C:\BuildTools
+
+# Upstream expat doesn't ship devel? let's build it then...
+# ADD https://github.com/libexpat/libexpat/releases/download/R_2_4_1/expat-win32bin-2.4.1.exe C:\TEMP\expat.exe
+# RUN C:\TEMP\expat.exe /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-
+RUN git clone --depth 1 --branch R_2_4_2 https://github.com/libexpat/libexpat
+WORKDIR "/libexpat/expat"
+RUN cmake --install-prefix c:/ -G '"Visual Studio 15 2017 Win64"' .
+RUN cmake --build . --config Release
+RUN cmake --install . --config Release
+
+# Build glib for MSVC
+RUN git clone --depth 1 --branch 2.70.2 https://gitlab.gnome.org/GNOME/glib.git \glib
+WORKDIR "/glib"
+RUN cmd /c 'C:\BuildTools\Common7\Tools\VsDevCmd.bat -arch=amd64 & meson setup builddir'
+RUN meson compile -C builddir
+RUN meson install --no-rebuild -C builddir

local/recipes/system/dbus/source.tmp/tools/docker/windows/Install.cmd

@@ -0,0 +1,19 @@
+@rem Copyright (C) Microsoft Corporation. All rights reserved.
+@rem https://github.com/MicrosoftDocs/visualstudio-docs/blob/main/docs/install/advanced-build-tools-container.md#install-script
+@rem Licensed under the MIT license.
+@rem SPDX-License-Identifier: MIT
+
+@if not defined _echo echo off
+setlocal enabledelayedexpansion
+
+call %*
+if "%ERRORLEVEL%"=="3010" (
+    exit /b 0
+) else (
+    if not "%ERRORLEVEL%"=="0" (
+        set ERR=%ERRORLEVEL%
+        call C:\TEMP\collect.exe -zip:C:\vslogs.zip
+
+        exit /b !ERR!
+    )
+)

local/recipes/system/dbus/source.tmp/tools/docker/windows/container.ps1

@@ -0,0 +1,60 @@
+# Copied from mesa, big kudos
+#
+# https://gitlab.freedesktop.org/mesa/mesa/-/blob/main/.gitlab-ci/windows/mesa_container.ps1
+# https://gitlab.freedesktop.org/mesa/mesa/-/blob/34e3e164936d1d3cef267da7780e87f062fedf39/.gitlab-ci/windows/mesa_container.ps1
+
+# Implements the equivalent of ci-templates container-ifnot-exists, using
+# Docker directly as we don't have buildah/podman/skopeo available under
+# Windows, nor can we execute Docker-in-Docker
+$registry_uri = $args[0]
+$registry_username = $args[1]
+$registry_password = $args[2]
+$registry_user_image = $args[3]
+$registry_central_image = $args[4]
+$dockerfile = $args[5]
+
+docker --config "windows-docker.conf" login -u "$registry_username" -p "$registry_password" "$registry_uri"
+if (!$?) {
+  Write-Host "docker login failed to $registry_uri"
+  Exit 1
+}
+
+# if the image already exists, don't rebuild it
+docker --config "windows-docker.conf" pull "$registry_user_image"
+if ($?) {
+  Write-Host "User image $registry_user_image already exists; not rebuilding"
+  docker --config "windows-docker.conf" logout "$registry_uri"
+  Exit 0
+}
+
+# if the image already exists upstream, copy it
+docker --config "windows-docker.conf" pull "$registry_central_image"
+if ($?) {
+  Write-Host "Copying central image $registry_central_image to user image $registry_user_image"
+  docker --config "windows-docker.conf" tag "$registry_central_image" "$registry_user_image"
+  docker --config "windows-docker.conf" push "$registry_user_image"
+  $pushstatus = $?
+  docker --config "windows-docker.conf" logout "$registry_uri"
+  if (!$pushstatus) {
+    Write-Host "Pushing image to $registry_user_image failed"
+    Exit 1
+  }
+  Exit 0
+}
+
+Write-Host "No image found at $registry_user_image or $registry_central_image; rebuilding"
+docker --config "windows-docker.conf" build $DOCKER_BUILD_ARGS --no-cache -t "$registry_user_image" -f "$dockerfile" "./tools/docker/windows"
+if (!$?) {
+  Write-Host "Container build failed"
+  docker --config "windows-docker.conf" logout "$registry_uri"
+  Exit 1
+}
+Get-Date
+
+docker --config "windows-docker.conf" push "$registry_user_image"
+$pushstatus = $?
+docker --config "windows-docker.conf" logout "$registry_uri"
+if (!$pushstatus) {
+  Write-Host "Pushing image to $registry_user_image failed"
+  Exit 1
+}