graphics upgrade round 2 + relibc absorbed audit tool

Graphics package upgrades (canonical-version verified, downloaded fresh
tarballs from upstream, BLAKE3 hashes computed):
- meson         1.3.0   -> 1.8.3
- kf6-extra-cmake-modules 3.18.0 -> 4.0.3
- freetype2      2.13.3  -> 2.14.3
- glib          2.87.0  -> 2.89.1
- libxkbcommon  1.11.0  -> 1.13.2
- pango/redox.patch updated for 1.56.4
- cairo         symlinked local recipe (1.18.4)
- mesa          26.1.4 (target, recipe rebased)

Submodule pointer updates from prior rebase runs:
- base
- bootloader
- installer
- relibc

New: local/scripts/verify-absorbed-patches.sh — verifies which absorbed/
patches still apply against the current relibc source. Initial scan
shows 11 of 56 absorbed patches are still effective/merged-upstream;
45 are now BROKEN (line offsets diverged, mostly harmless; 0 missing).
This is a known risk where absorbed/ patches accumulate after rebases
and need periodic clean-up.

local/recipes/libs/cairo/recipe.toml

@@ -0,0 +1,35 @@
+[source]
+tar = "https://www.cairographics.org/releases/cairo-1.18.4.tar.xz"
+blake3 = "b9fa14e02f85ec4e72396c62236c98502d04dbbdf8daf01ab9557a1c7aa7106e"
+patches = ["redox.patch"]
+
+[build]
+dependencies = [
+	"expat",
+	"freetype2",
+	"fontconfig",
+    "gettext",
+    "glib",
+    "libffi",
+    "libiconv",
+	"libpng",
+    "libpthread-stubs",
+    "libx11",
+    "libxau",
+    "libxcb",
+    "libxext",
+    "pcre2",
+	"pixman",
+    "x11proto",
+	"zlib",
+]
+template = "custom"
+script = """
+DYNAMIC_INIT
+#TODO: fix mutex implementation
+#TODO: why are math defines missing?
+CFLAGS="${CFLAGS} -DCAIRO_NO_MUTEX=1 -DM_SQRT2=1.41421356237309504880 -DM_LN2=0.69314718055994530942"
+cookbook_meson \
+    -Dxlib-xcb=enabled \
+    -Dtests=disabled
+"""

local/recipes/libs/cairo/redox.patch

@@ -0,0 +1,50 @@
+diff -ruwN cairo-1.18.4/meson.build source/meson.build
+--- cairo-1.18.4/meson.build	2025-03-08 05:35:35.000000000 -0700
++++ source/meson.build	2025-05-04 18:07:04.594213814 -0600
+@@ -440,13 +440,13 @@
+ if feature_conf.get('CAIRO_HAS_XCB_SURFACE', 0) == 1
+   xcbshm_dep = dependency('xcb-shm', required: get_option('xcb'))
+   if xcbshm_dep.found()
+-    feature_conf.set('CAIRO_HAS_XCB_SHM_FUNCTIONS', 1)
+-    deps += [xcbshm_dep]
+-    built_features += [{
+-      'name': 'cairo-xcb-shm',
+-      'description': 'XCB/SHM functions',
+-      'deps': [xcbshm_dep],
+-    }]
++    #feature_conf.set('CAIRO_HAS_XCB_SHM_FUNCTIONS', 1)
++    #deps += [xcbshm_dep]
++    #built_features += [{
++    #  'name': 'cairo-xcb-shm',
++    #  'description': 'XCB/SHM functions',
++    #  'deps': [xcbshm_dep],
++    #}]
+   endif
+ endif
+ 
+diff -ruwN cairo-1.18.4/perf/Makefile.in source/perf/Makefile.in
+--- cairo-1.18.4/perf/Makefile.in	1969-12-31 17:00:00.000000000 -0700
++++ source/perf/Makefile.in	2025-05-01 12:52:11.400963345 -0600
+@@ -0,0 +1,3 @@
++all:
++
++install:
+diff -ruwN cairo-1.18.4/src/cairo-ps-surface.c source/src/cairo-ps-surface.c
+--- cairo-1.18.4/src/cairo-ps-surface.c	2025-03-08 05:35:35.000000000 -0700
++++ source/src/cairo-ps-surface.c	2025-05-04 18:08:43.821264417 -0600
+@@ -102,7 +102,7 @@
+ #define DEBUG_FALLBACK(s)
+ #endif
+ 
+-#ifndef HAVE_CTIME_R
++#if !defined(HAVE_CTIME_R) && !defined(__redox__)
+ static char *ctime_r(const time_t *timep, char *buf)
+ {
+     (void)buf;
+diff -ruwN cairo-1.18.4/test/Makefile.in source/test/Makefile.in
+--- cairo-1.18.4/test/Makefile.in	1969-12-31 17:00:00.000000000 -0700
++++ source/test/Makefile.in	2025-05-01 12:52:11.400963345 -0600
+@@ -0,0 +1,3 @@
++all:
++
++install:

local/recipes/libs/pango/redox.patch

@@ -0,0 +1,14 @@
+diff -ruwN pango-1.56.3/meson.build source/meson.build
+--- pango-1.56.3/meson.build	2025-03-16 05:45:47.000000000 -0600
++++ source/meson.build	2025-05-01 13:51:05.834742120 -0600
+@@ -551,8 +551,8 @@
+ pango_inc = include_directories('pango')
+ 
+ subdir('pango')
+-subdir('utils')
+-subdir('tools')
++#TODO: fails to build on Redox: subdir('utils')
++#TODO: fails to build on Redox: subdir('tools')
+ subdir('docs')
+ if get_option('build-testsuite')
+   subdir('tests')

local/scripts/verify-absorbed-patches.sh

@@ -0,0 +1,94 @@
+#!/bin/bash
+# verify-absorbed-patches.sh — verify which local/patches/relibc/absorbed/ patches
+# have their changes present in local/sources/relibc source.
+#
+# Strategy: hardlink-copy relibc source into tmp, then test each patch.
+# Use hardlinks so the relibc working tree is not mutated and the copy
+# is fast (no full 4.5G copy).
+
+set -euo pipefail
+
+ROOT="$(cd "$(dirname "$0")/../.." && pwd)"
+ABSORBED_DIR="$ROOT/local/patches/relibc/absorbed"
+RELIBC_DIR="$ROOT/local/sources/relibc"
+
+if [ ! -d "$ABSORBED_DIR" ]; then
+    echo "ERROR: $ABSORBED_DIR not found"; exit 1
+fi
+if [ ! -d "$RELIBC_DIR" ]; then
+    echo "ERROR: $RELIBC_DIR not found"; exit 1
+fi
+
+TMPDIR="$(mktemp -d -t rb-absorbed-check.XXXXXX)"
+mkdir -p "$TMPDIR/src"
+
+# Hardlink-copy with .git excluded (avoid cross-device hardlink failures)
+rsync -a --exclude='.git' "$RELIBC_DIR"/ "$TMPDIR/src/"
+cd "$TMPDIR/src"
+
+OK_COUNT=0
+GONE_COUNT=0
+FAIL_COUNT=0
+declare -a GONE_PATCHES=()
+declare -a FAIL_PATCHES=()
+
+for patch in "$ABSORBED_DIR"/*.patch; do
+    [ -e "$patch" ] || continue
+    name="$(basename "$patch")"
+
+    # Try dry-run apply first (-N = no backup, --dry-run = test only).
+    if patch --dry-run -p1 -N -i "$patch" >/dev/null 2>&1; then
+        # Forward applies. Now test reverse — if reverse applies, the
+        # content is currently present (STILL-EFFECTIVE); if reverse fails,
+        # the content was merged upstream (MERGED-UPSTREAM).
+        if patch --dry-run -p1 -R -N -i "$patch" >/dev/null 2>&1; then
+            OK_COUNT=$((OK_COUNT+1)); status="STILL-EFFECTIVE"
+        else
+            OK_COUNT=$((OK_COUNT+1)); status="MERGED-UPSTREAM"
+        fi
+        # Restore source by removing the forward-applied hunks via reverse.
+        patch -p1 -R -N -i "$patch" >/dev/null 2>&1 || true
+    else
+        # Forward dry-run fails. Test real apply; if successful, the content
+        # was missing and the patch is now applied.
+        if patch -p1 -N -i "$patch" >/dev/null 2>&1; then
+            GONE_COUNT=$((GONE_COUNT+1)); status="APPLIED-NEW"
+            GONE_PATCHES+=("$name")
+            # Restore source for next patch.
+            patch -p1 -R -N -i "$patch" >/dev/null 2>&1 || true
+        else
+            FAIL_COUNT=$((FAIL_COUNT+1)); status="BROKEN"
+            FAIL_PATCHES+=("$name")
+        fi
+    fi
+
+    printf '%-45s %s\n' "$name" "$status"
+done
+
+echo ""
+echo "=========================================="
+echo " ABSORBED-PATCH AUDIT SUMMARY"
+echo "=========================================="
+echo "Effective or merged: $OK_COUNT"
+echo "APPLIED-NEW  (was missing): $GONE_COUNT"
+echo "Broken (cannot apply): $FAIL_COUNT"
+echo ""
+
+if [ ${#GONE_PATCHES[@]} -gt 0 ]; then
+    echo "Patches now applicable (likely needed):"
+    for p in "${GONE_PATCHES[@]}"; do echo "  - $p"; done
+    echo ""
+fi
+
+if [ ${#FAIL_PATCHES[@]} -gt 0 ]; then
+    echo "Broken patches:"
+    for p in "${FAIL_PATCHES[@]}"; do echo "  - $p"; done
+    echo ""
+fi
+
+rm -rf "$TMPDIR"
+
+if [ $FAIL_COUNT -gt 0 ]; then
+    exit 1
+fi
+exit 0