Added missing locale command support:

packages/bare-os-coreutils/src/locale.js
registered in packages/bare-os-coreutils/lib/commands.mjs
Fixed trustctl generated runtime mismatch:

added preamble wiring in packages/bare-os-coreutils/build.mjs (trustctl: ['p2p-suite.js'])
Improved help behavior:

packages/bare-os-coreutils/src/ssh-keygen.js (help, -h, --help, -?)
packages/bare-os-coreutils/src/oidc-publish.js (help detection across args)
Improved procstat empty-state UX while preserving JSON output:

packages/bare-os-coreutils/src/procstat.js
adds sourcePath and additive hint when process table is empty
Enforced stricter network behavior:

packages/bare-os-coreutils/src/whois.js
prefers ctx.httpFetch, adds bounded timeout via AbortController
clearer timeout/policy/offline error mapping
packages/bare-os-coreutils/src/telnet.js
strict-close behavior by default
--strict-close / --no-strict-close
BARE_OS_TELNET_STRICT_CLOSE env override
Implemented expected-item UX/compat updates:

packages/bare-os-coreutils/src/iconv.js: added -l/--list, improved encoding-pair error messaging
packages/bare-os-coreutils/src/crontab.js: clearer -l empty-file message
packages/bare-os-coreutils/src/getconf.js: added PAGE_SIZE / PAGESIZE aliases
packages/bare-os-coreutils/src/nproc.js: clarified help text
packages/bare-os-coreutils/src/time.js: clarified output comments/behavior

kernel/bin/ssh-keygen

@@ -91,16 +91,22 @@ function bareOsEmitRaw(ctx, chunk) {
  * Ed25519 key generation via booter `ssh-keygen-cli.js` (bare-crypto + VFS).
  */
 async function run(ctx, argv) {
-  if (typeof ctx.bareOsRunSshKeygenCli === 'function') {
-    await ctx.bareOsRunSshKeygenCli(argv)
-    return
-  }
   const args = argv.slice(1)
-  if (args.includes('-h') || args.includes('--help') || args.includes('-?')) {
+  if (
+    args.includes('help') ||
+    args.includes('-h') ||
+    args.includes('--help') ||
+    args.includes('-?')
+  ) {
     ctx.console.log(
       'Usage: ssh-keygen -t ed25519 -f KEYFILE [-N ""] [-C comment]\n' +
         'Requires ctx.bareOsRunSshKeygenCli from the stock booter.'
     )
+    ctx.exitCode = 0
+    return
+  }
+  if (typeof ctx.bareOsRunSshKeygenCli === 'function') {
+    await ctx.bareOsRunSshKeygenCli(argv)
     return
   }
   ctx.console.error(