CHANGELOG: document build system patch verification (make verify-patches)

The new `make verify-patches` target runs
`local/scripts/check-cargo-patches.sh` which verifies
all [patch.crates-io] and [patch.'<URL>'] sections in
local sources' Cargo.toml files resolve to the expected
local fork paths. The kernel's Phase J patch
([patch.'<URL>'] redox_syscall for the URL-based
overrides of the git-URL dependency) is verified
end-to-end.

The user requested 'build system must report complete when
upstream have our patches applied' — this is now an
explicit Makefile target. Hardware-agnostic: works for
any Red Bear OS checkout.

CHANGELOG.md

@@ -160,6 +160,40 @@ sync with the newest highlights.
   successfully with all Phase J commits. The patch system
   works end-to-end.
 
+## 2026-07-01 — Build system: explicit patch verification
+
+The user requested "build system must report complete when
+upstream have our patches applied". This session adds the
+explicit verification tools:
+
+- **`local/scripts/check-cargo-patches.sh`** (Improvement C):
+  For each local source's `Cargo.toml`, scans for
+  `[patch.crates-io]` and `[patch."<URL>"]` sections,
+  resolves the patch via `cargo metadata`, and verifies
+  that the resolved source URL (or manifest_path for
+  path-deps) matches the expected local fork path. Returns
+  non-zero on any unresolved patch. Wraps `cargo metadata`
+  in a 30s timeout to handle large workspaces (relibc,
+  base). Explicitly skips relibc (its `[patch]` is only the
+  cc-rs git branch override, no `path` patches).
+- **`make verify-patches`**: runs the above script. The
+  current kernel Phase J patch
+  ([patch."<URL>"] redox_syscall) is verified
+  end-to-end.
+- **`make verify-file-patches`**: runs
+  `local/scripts/check-unwired-patches.sh --strict` which
+  verifies all file-level .patch files in `local/patches/`
+  are referenced by at least one recipe.toml `patches = [...]`
+  entry.
+- **`make verify-all`**: runs both. The comprehensive
+  Phase J end-to-end verification. Returns non-zero on any
+  failure (CI-friendly).
+
+The cookbook itself already logs `[SUMMARY] All N patches
+validated successfully` for file-level patches. These new
+Makefile targets make the verification part of the standard
+build workflow.
+
 ## 2026-07-01 — cpufreqd oscillation fixed (kernel MSR scheme + VM detection)
 
 ### Kernel fix: `sys` scheme path-strip ENOENT bug (kernel fork commit `c231262`)