crypto: simplify entropy path after audit review

- Lift duplicated identity-gen block from main_companion.cpp +
  main_repeater.cpp into ZephyrRNG::generateFirstBootIdentity().
  Both mains shrink from ~40 lines to a 3-line helper call.
- Add LocalIdentity::fromSeed() so seed-derived keygen doesn't need
  a one-shot RNG wrapper; delete SeededRNG.
- Drop the per-byte ADC sampling loop: getBattMilliVolts() does an
  8-sample average + 10ms regulator settle internally, costing
  300-480ms of real wall-time and actively destroying the LSB jitter
  it was meant to harvest. Jitter mixer already dwarfs it.
- Centralize the printk + sys_reboot pattern as
  Utils::cryptoPanicReboot(); drop the 2000ms pre-reboot k_msleep
  (printk is synchronous, sleep just blocked the mesh thread on
  the ZephyrRNG::random() retry-failure path).
- Inline sample_cpu_jitter health check via online scalars instead
  of a 512-byte deltas[] array. Saves 1.5KB stack churn across boot
  and tracks every sample instead of only the first 128.
- extract_via_aes_ctr now uses Utils::sha256 instead of open-coding
  psa_hash_compute.

zephcore/src/Identity.cpp

@@ -54,6 +54,12 @@ LocalIdentity::LocalIdentity(RNG *rng)
 	uint8_t seed[SEED_SIZE];
 	rng->random(seed, SEED_SIZE);
 	ed25519_create_keypair(pub_key, prv_key, seed);
+	Utils::secureZeroize(seed, sizeof(seed));
+}
+
+void LocalIdentity::fromSeed(const uint8_t seed[SEED_SIZE])
+{
+	ed25519_create_keypair(pub_key, prv_key, seed);
 }
 
 bool LocalIdentity::validatePrivateKey(const uint8_t prv[64])