errno: -1 is EPERM, and four places were saying it by accident

Ctrl-C killed the shell. consoleread() breaks off the read in progress when
SIGINT arrives and returned -1 to do it -- and -1 is -EPERM by the time it
reaches a program, so every program that handles SIGINT by carrying on saw a
permanent error instead of an interrupted call:

    zsh: error on TTY read: operation not permitted
    schinitd: restarting os.schos.console-shell

and the next Ctrl-C did it to the replacement. EINTR now, which is what a
signal-interrupted read is required to give. Verified: Ctrl-C an interruptible
command, shell survives, zero restarts.

Same mistake, same file family: link, unlink, rename and renameat returned -1
on every error path. Callers branch on errno -- `if (unlink(p) < 0 && errno !=
ENOENT)` is the standard shape, and against EPERM it always complains -- which
is why zsh reported failures for things that had worked. They return ENOENT,
EEXIST, EXDEV, EISDIR, ENOTEMPTY and EFAULT now. About ninety other `return -1`s
remain in sys_fs.c; these four are done because these four were what a program
tripped over. /dev/mem's unknown minors return ENODEV rather than -1 too.

/dev/urandom was a linear congruential generator seeded with a **constant**, so
every boot produced the same bytes in the same order -- not weak, the same. A
key, a nonce, a temporary filename: shared with every SchOS machine that had
ever run. Seeded at boot from RDRAND where the CPU has it, from the cycle
counter and the wall clock where it does not, and re-stirred per byte. Still an
LCG and still not a CSPRNG; what changed is the part that was dangerous rather
than merely poor.

**Not fixed, and recorded as such:** rename() still will not replace an existing
target, so zsh's history save fails on every exit after the first. An attempt to
unlink the target first was reverted -- the directory is an HTree, dirunlink
followed by dirlink of the same name did not behave, and it panicked in
filewrite with the old file already gone. Losing both files is worse than
refusing, so it refuses until the HTree's slot reuse is understood.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VQ7Qx8E1q1M1bbCq8QLHS2

kernel/core/main.c

@@ -221,22 +221,22 @@ kmain(uint32 fb_addr)
   // sinit: kthread_create needs a usable process table. From here on Ctrl-G
   // on the console answers, with no filesystem mounted and nothing in
   // userspace started -- which is the whole point of putting it this early.
+  // After timeinit(), which is what boot_epoch comes from, and before any
+  // program can ask for a random byte.
+  random_init();
   netuser_init();
   dbg_thread_start();
   if (boot_verbose) cprintf("verbose boot: dbg thread started\n");
 
-  // The one line a working boot prints.
+  // The greeting is not printed here.
   //
-  // Everything above this is a kinfo(), which means it is in the klog and not
-  // on the screen -- the whole boot is still there, it is simply not the first
-  // thing anybody has to read every morning. What is left is the fact that the
-  // machine came up, and where the rest went if it did not.
+  // It was, and it landed before userspace had said anything -- so on a quiet
+  // boot it was followed by the last few lines of `schinit` and whatever the
+  // jobs had to say, which is the wrong way round for a line whose whole job is
+  // to be the last thing you read. It belongs at the end of the thing it is
+  // announcing, and the end of the thing it is announcing is in userspace.
   //
-  // A verbose boot has already said thirty other things and does not need a
-  // greeting on top of them.
-  if (!boot_verbose)
-    cprintf("\nWelcome to SchOS!  (F8 at boot for the full log, or dmesg once you are in)\n\n");
-
+  // schinitd prints it, once its RunAtLoad jobs are away. See cmd/schinitd.
   mpmain();
 }