base-system-2: promover 7 tier-2 a canónicas + repo firmado

shadow (useradd/passwd), kbd (loadkeys/setfont), procps-ng (ps/top/free), pciutils (lspci),
lsof, strace, mandoc (man) → recipes/ canónicas + índice firmado. usbutils (falta libusb) y
gnupg (falta libassuan/libksba/npth) quedan staged/bloqueados; foot diferido (Wayland).
Segunda tanda del userland foundational: usuarios + teclado + proceso + hardware + docs + debug.

recipes/hassecurity.patch

@@ -0,0 +1,11 @@
+--- a/lib/dialects/linux/machine.h
++++ b/lib/dialects/linux/machine.h
+@@ -390,7 +390,7 @@
+  * (the one that its user logged on with) of the lsof process.
+  */
+ 
+-/* #define	HASSECURITY	1 */
++#define	HASSECURITY	1
+ 
+ /*
+  * If HASSECURITY is defined, define HASNOSOCKSECURITY to allow users