Complete the internal “100 task” roadmap: coreutils and shell parity (xargs,

sh, diff/patch, sort, printf, find, test, getfacl/setfacl/xattr), expanded
/proc and metrics (process table, syscalls, replication, net, security
posture, worker budget, swarm/replication hints), initd DAG supervision
metadata and richer restart journal telemetry, synthetic process groups via
IPC (assignProcessGroup/signalProcessGroup) mirrored into process_table,
optional kernel.ext.d incremental hot reload (BARE_OS_KERNEL_EXT_D_HOT_RELOAD)
with reload audit NDJSON, features proc for hyperblobs dedup and systemd
subset documentation, vault threat model doc plus posture fields for AEAD,
Pear enclave pointer, account rotation continuity, and Ed25519 consistency
across boot manifest / extensions / replication. Adds or extends tests and
keeps kernel/ and packages/bare-os-seeder/kernel/ in parity; guest init is
bundled from kernel/lib/init/init-main.js via bundle-kernel-init.

packages/bare-os-coreutils/man/pages/patch.json

@@ -0,0 +1,16 @@
+{
+  "name": "patch",
+  "section": 1,
+  "title": "apply a diff file",
+  "synopsis": ["patch [-pNUM] [--dry-run] [FILE]"],
+  "description": "Reads a unified diff from **`stdin`** (`ctx.shellStdin`) and applies it to **`FILE`** or the path from the **`+++`** header. Supports **`-p`** path strip count and **`--dry-run`** (verify hunk without writing).",
+  "options": [
+    { "flag": "-p NUM", "meaning": "Strip NUM leading path segments from paths in the patch" },
+    { "flag": "--dry-run, --check", "meaning": "Check patch without modifying files" }
+  ],
+  "keywords": ["patch", "diff", "bare-os", "coreutils"],
+  "bareOsNotes": "Minimal hunk parser; only patches matching the whole-file content implied by the hunk. See **`src/patch.js`**.",
+  "examples": [
+    { "caption": "apply from shell stdin redirection", "code": "patch -p0 < fix.patch" }
+  ]
+}