G.2 (v2.0.0): unified rng_get_bytes() entropy entry point; virtio-rng sole backend

The QEMU-verifiable slice of the real-hardware RNG driver (per FABRIC-3.md
§G.2). New include/starkernel/rng.h + src/starkernel/rng/rng.c provide the
single entropy entry point: rng_init() probes the backend set (v2.0.0:
virtio-rng only) and, on no backend, prints a loud boot-time warning while
rng_get_bytes() returns RNG_ERR_NO_BACKEND - never silently degrading to a
deterministic seed. The backend-selection switch in rng.c is the exact seam
v2.5.0's per-arch drivers (amd64 RDRAND, riscv64 Zkr, aarch64 peripheral) plug
into without touching the call path.

Consumers route through the unified layer instead of virtio-rng directly:
capsule_mint.c (identity seed + drive_uuid) and kernel_main.c phase 8
(rng_init()). virtio_rng.c stays as the sole backend. Built clean on
amd64/aarch64/riscv64. QEMU amd64 boot: POST 1012/0/0 + ok>, "rng: backend =
virtio-rng" + "entropy: ready", Zuse identity confirmed from thumbdrive -
mint/cert behavior unchanged.

FABRIC-3.md §G.2 v2.0.0 slice marked BUILT+VERIFIED.

Makefile.starkernel

@@ -431,6 +431,7 @@ LOADER_SRCS_BASE := \
     $(wildcard $(KERNEL_SRC)/capsule/*.c) \
     $(wildcard $(KERNEL_SRC)/pci/*.c) \
     $(wildcard $(KERNEL_SRC)/virtio/*.c) \
+    $(wildcard $(KERNEL_SRC)/rng/*.c) \
     $(wildcard $(KERNEL_SRC)/usb/*.c) \
     $(KERNEL_SRC)/repl.c \
     $(KERNEL_SRC)/doe_log.c \
@@ -483,6 +484,7 @@ KERNEL_SRCS_BASE := \
     $(wildcard $(KERNEL_SRC)/capsule/*.c) \
     $(wildcard $(KERNEL_SRC)/pci/*.c) \
     $(wildcard $(KERNEL_SRC)/virtio/*.c) \
+    $(wildcard $(KERNEL_SRC)/rng/*.c) \
     $(wildcard $(KERNEL_SRC)/usb/*.c) \
     $(wildcard $(KERNEL_SRC)/arch/$(ARCH)/*.c) \
     $(KERNEL_SRC)/repl.c \