Never wait minutes on the kernel's randomness at start

[keyldev]

• Every command seeded mbedTLS before doing anything, status included, and on some cameras that read blocked for minutes on each start; the agent sat silent that long after every restart
• The generator is now seeded on first use only: status, snapshot, motion and clean need no randomness and answer at once
• Seeding mixes what the kernel has ready without waiting with a seed kept in /etc/cerberus/seed and replaced on every start; waiting happens once in a device's life, when there is neither
• The release build's PSA draws from that generator (MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG) instead of gathering a second time