crypto: simplify entropy path after audit review

- Lift duplicated identity-gen block from main_companion.cpp +
  main_repeater.cpp into ZephyrRNG::generateFirstBootIdentity().
  Both mains shrink from ~40 lines to a 3-line helper call.
- Add LocalIdentity::fromSeed() so seed-derived keygen doesn't need
  a one-shot RNG wrapper; delete SeededRNG.
- Drop the per-byte ADC sampling loop: getBattMilliVolts() does an
  8-sample average + 10ms regulator settle internally, costing
  300-480ms of real wall-time and actively destroying the LSB jitter
  it was meant to harvest. Jitter mixer already dwarfs it.
- Centralize the printk + sys_reboot pattern as
  Utils::cryptoPanicReboot(); drop the 2000ms pre-reboot k_msleep
  (printk is synchronous, sleep just blocked the mesh thread on
  the ZephyrRNG::random() retry-failure path).
- Inline sample_cpu_jitter health check via online scalars instead
  of a 512-byte deltas[] array. Saves 1.5KB stack churn across boot
  and tracks every sample instead of only the first 128.
- extract_via_aes_ctr now uses Utils::sha256 instead of open-coding
  psa_hash_compute.

zephcore/include/mesh/Identity.h

@@ -49,6 +49,13 @@ public:
 	LocalIdentity(const char *prv_hex, const char *pub_hex);
 	LocalIdentity(RNG *rng);
 
+	/* Derive Ed25519 keypair from a 32-byte seed. Use this when you've
+	 * already produced a high-quality seed externally (e.g. via the
+	 * layered ZephyrRNG::mixIdentitySeed entropy mixer) — avoids the
+	 * one-shot-RNG-wrapper dance otherwise needed to feed bytes
+	 * through the LocalIdentity(RNG*) constructor. */
+	void fromSeed(const uint8_t seed[SEED_SIZE]);
+
 	void sign(uint8_t *sig, const uint8_t *message, int msg_len) const;
 	void calcSharedSecret(uint8_t *secret, const Identity &other) const { calcSharedSecret(secret, other.pub_key); }
 	void calcSharedSecret(uint8_t *secret, const uint8_t *other_pub_key) const;

zephcore/include/mesh/Utils.h

@@ -34,6 +34,13 @@ public:
 	 * secrets after their last use. */
 	static void secureZeroize(void *buf, size_t n);
 
+	/* Log a crypto-invariant failure to printk and cold-reboot.
+	 * Used when an entropy source, KDF, or other primitive cannot
+	 * produce a safe result — proceeding would risk weak keys or
+	 * bypassed authentication, so we restart rather than continue.
+	 * Does not return. */
+	[[noreturn]] static void cryptoPanicReboot(const char *msg);
+
 	static void toHex(char *dest, const uint8_t *src, size_t len);
 	static bool fromHex(uint8_t *dest, int dest_size, const char *src_hex);
 	static bool isHexChar(char c);