crypto: simplify entropy path after audit review

- Lift duplicated identity-gen block from main_companion.cpp +
  main_repeater.cpp into ZephyrRNG::generateFirstBootIdentity().
  Both mains shrink from ~40 lines to a 3-line helper call.
- Add LocalIdentity::fromSeed() so seed-derived keygen doesn't need
  a one-shot RNG wrapper; delete SeededRNG.
- Drop the per-byte ADC sampling loop: getBattMilliVolts() does an
  8-sample average + 10ms regulator settle internally, costing
  300-480ms of real wall-time and actively destroying the LSB jitter
  it was meant to harvest. Jitter mixer already dwarfs it.
- Centralize the printk + sys_reboot pattern as
  Utils::cryptoPanicReboot(); drop the 2000ms pre-reboot k_msleep
  (printk is synchronous, sleep just blocked the mesh thread on
  the ZephyrRNG::random() retry-failure path).
- Inline sample_cpu_jitter health check via online scalars instead
  of a 512-byte deltas[] array. Saves 1.5KB stack churn across boot
  and tracks every sample instead of only the first 128.
- extract_via_aes_ctr now uses Utils::sha256 instead of open-coding
  psa_hash_compute.

zephcore/src/Utils.cpp

@@ -6,6 +6,8 @@
 #include <mesh/Utils.h>
 #include <psa/crypto.h>
 #include <string.h>
+#include <zephyr/sys/printk.h>
+#include <zephyr/sys/reboot.h>
 
 #include <zephyr/logging/log.h>
 LOG_MODULE_REGISTER(zephcore_utils, CONFIG_ZEPHCORE_MAIN_LOG_LEVEL);
@@ -205,6 +207,17 @@ bool Utils::constantTimeEqual(const void *a, const void *b, size_t n)
 	return result == 0;
 }
 
+void Utils::cryptoPanicReboot(const char *msg)
+{
+	/* No pre-reboot k_msleep: printk is synchronous on RTT/UART so the
+	 * line is already on the wire by the time sys_reboot fires, and the
+	 * 2-second delay we used to do here just blocked the mesh thread on
+	 * the rare-but-realistic ZephyrRNG::random() retry failure path. */
+	printk("crypto panic: %s — rebooting\n", msg ? msg : "(no detail)");
+	sys_reboot(SYS_REBOOT_COLD);
+	for (;;) { /* sys_reboot is FUNC_NORETURN, but satisfy [[noreturn]] */ }
+}
+
 void Utils::secureZeroize(void *buf, size_t n)
 {
 	/* Volatile pointer prevents the compiler from eliminating the