base-system-2: promover 7 tier-2 a canónicas + repo firmado

shadow (useradd/passwd), kbd (loadkeys/setfont), procps-ng (ps/top/free), pciutils (lspci),
lsof, strace, mandoc (man) → recipes/ canónicas + índice firmado. usbutils (falta libusb) y
gnupg (falta libassuan/libksba/npth) quedan staged/bloqueados; foot diferido (Wayland).
Segunda tanda del userland foundational: usuarios + teclado + proceso + hardware + docs + debug.

recipes/lex.patch

@@ -0,0 +1,15 @@
+Lexer is never run so don't bother
+
+--- a/configure
++++ b/configure
+@@ -7131,10 +7131,6 @@
+ rm -f conftest.l $LEX_OUTPUT_ROOT.c
+ 
+ fi
+-if test "x$LEX" != xflex
+-then :
+-  as_fn_error $? "kbd depends on flex features, but found '$LEX'." "$LINENO" 5
+-fi
+ 
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking whether C compiler accepts -std=gnu11" >&5
+ printf %s "checking whether C compiler accepts -std=gnu11... " >&6; }