feat: Power-off fix for the Steam Machine; the kernel pin is optional

Kernels >= 7.2 keep the firmware's S4/S5 wake bit on GPIO pin 18, so the
Steam Machine starts again right after powering off. Steam Machine
support now builds a DKMS module (patches/steamify-fremont-poweroff.c)
that clears it before power-off, for every kernel. The kernel pin is no
longer ticked by default. Module sources and patches move to patches/,
embedded by the single-file build.

AGENTS.md

@@ -15,6 +15,10 @@ gamescope and the Plasma desktop. Primary target: the Valve Steam Machine
 - `steamify.sh` - the only entry point. Pre-flight checks,
   sources `lib/*.sh`, runs the menu and applies the plan. No component
   logic here.
+- `patches/` - kernel module sources and patches the scripts build or
+  apply, never inline in the shell code. Read them with `patch_file
+  <name>` (`lib/common.sh`, from the checkout); the bundle embeds every file
+  in `patches/` and overrides `patch_file`. Add new ones to its README.
 - `lib/*.sh` - one file per responsibility, each defining functions only
   (no top-level side effects besides constants). See the table in
   `TECHNICAL.md`.
@@ -204,6 +208,16 @@ gamescope and the Plasma desktop. Primary target: the Valve Steam Machine
   kernel only pairs that with a named lookup ("Port C") when the CEC driver
   registered first, which never happens since amdgpu loads from the
   initramfs. Without it `/dev/cec0` exists but stays at `f.f.f.f`.
+- Power-off fix (`lib/fremont-poweroff.sh`, part of `machine`): kernels
+  >= 7.2 keep the firmware's S4/S5 wake bit on GPIO pin 18, so the Steam
+  Machine boots again right after powering off (Valve's kernel clears it at
+  probe, not for upstream). The DKMS module `steamify-fremont-poweroff`
+  (`patches/steamify-fremont-poweroff.c`) clears it in a power-off-prepare
+  handler, for every kernel. It made the kernel pin optional (`kpin` is in
+  `NO_PRESELECT`, no longer ticked with `machine`). `machine_repair` ticks
+  `machine` for setups without it. CachyOS's `linux-cachyos` is clang-built,
+  `-bore` GCC-built: let DKMS pick the compiler, never pass `LLVM=1`. Test
+  shutdown on the real machine for every new major kernel.
 - `Relogin=true` means a gamescope that fails to start is relaunched in a
   tight loop; keep that in mind when changing session handling.