graphics upgrade round 2 + relibc absorbed audit tool

Graphics package upgrades (canonical-version verified, downloaded fresh
tarballs from upstream, BLAKE3 hashes computed):
- meson         1.3.0   -> 1.8.3
- kf6-extra-cmake-modules 3.18.0 -> 4.0.3
- freetype2      2.13.3  -> 2.14.3
- glib          2.87.0  -> 2.89.1
- libxkbcommon  1.11.0  -> 1.13.2
- pango/redox.patch updated for 1.56.4
- cairo         symlinked local recipe (1.18.4)
- mesa          26.1.4 (target, recipe rebased)

Submodule pointer updates from prior rebase runs:
- base
- bootloader
- installer
- relibc

New: local/scripts/verify-absorbed-patches.sh — verifies which absorbed/
patches still apply against the current relibc source. Initial scan
shows 11 of 56 absorbed patches are still effective/merged-upstream;
45 are now BROKEN (line offsets diverged, mostly harmless; 0 missing).
This is a known risk where absorbed/ patches accumulate after rebases
and need periodic clean-up.

local/scripts/verify-absorbed-patches.sh

@@ -0,0 +1,94 @@
+#!/bin/bash
+# verify-absorbed-patches.sh — verify which local/patches/relibc/absorbed/ patches
+# have their changes present in local/sources/relibc source.
+#
+# Strategy: hardlink-copy relibc source into tmp, then test each patch.
+# Use hardlinks so the relibc working tree is not mutated and the copy
+# is fast (no full 4.5G copy).
+
+set -euo pipefail
+
+ROOT="$(cd "$(dirname "$0")/../.." && pwd)"
+ABSORBED_DIR="$ROOT/local/patches/relibc/absorbed"
+RELIBC_DIR="$ROOT/local/sources/relibc"
+
+if [ ! -d "$ABSORBED_DIR" ]; then
+    echo "ERROR: $ABSORBED_DIR not found"; exit 1
+fi
+if [ ! -d "$RELIBC_DIR" ]; then
+    echo "ERROR: $RELIBC_DIR not found"; exit 1
+fi
+
+TMPDIR="$(mktemp -d -t rb-absorbed-check.XXXXXX)"
+mkdir -p "$TMPDIR/src"
+
+# Hardlink-copy with .git excluded (avoid cross-device hardlink failures)
+rsync -a --exclude='.git' "$RELIBC_DIR"/ "$TMPDIR/src/"
+cd "$TMPDIR/src"
+
+OK_COUNT=0
+GONE_COUNT=0
+FAIL_COUNT=0
+declare -a GONE_PATCHES=()
+declare -a FAIL_PATCHES=()
+
+for patch in "$ABSORBED_DIR"/*.patch; do
+    [ -e "$patch" ] || continue
+    name="$(basename "$patch")"
+
+    # Try dry-run apply first (-N = no backup, --dry-run = test only).
+    if patch --dry-run -p1 -N -i "$patch" >/dev/null 2>&1; then
+        # Forward applies. Now test reverse — if reverse applies, the
+        # content is currently present (STILL-EFFECTIVE); if reverse fails,
+        # the content was merged upstream (MERGED-UPSTREAM).
+        if patch --dry-run -p1 -R -N -i "$patch" >/dev/null 2>&1; then
+            OK_COUNT=$((OK_COUNT+1)); status="STILL-EFFECTIVE"
+        else
+            OK_COUNT=$((OK_COUNT+1)); status="MERGED-UPSTREAM"
+        fi
+        # Restore source by removing the forward-applied hunks via reverse.
+        patch -p1 -R -N -i "$patch" >/dev/null 2>&1 || true
+    else
+        # Forward dry-run fails. Test real apply; if successful, the content
+        # was missing and the patch is now applied.
+        if patch -p1 -N -i "$patch" >/dev/null 2>&1; then
+            GONE_COUNT=$((GONE_COUNT+1)); status="APPLIED-NEW"
+            GONE_PATCHES+=("$name")
+            # Restore source for next patch.
+            patch -p1 -R -N -i "$patch" >/dev/null 2>&1 || true
+        else
+            FAIL_COUNT=$((FAIL_COUNT+1)); status="BROKEN"
+            FAIL_PATCHES+=("$name")
+        fi
+    fi
+
+    printf '%-45s %s\n' "$name" "$status"
+done
+
+echo ""
+echo "=========================================="
+echo " ABSORBED-PATCH AUDIT SUMMARY"
+echo "=========================================="
+echo "Effective or merged: $OK_COUNT"
+echo "APPLIED-NEW  (was missing): $GONE_COUNT"
+echo "Broken (cannot apply): $FAIL_COUNT"
+echo ""
+
+if [ ${#GONE_PATCHES[@]} -gt 0 ]; then
+    echo "Patches now applicable (likely needed):"
+    for p in "${GONE_PATCHES[@]}"; do echo "  - $p"; done
+    echo ""
+fi
+
+if [ ${#FAIL_PATCHES[@]} -gt 0 ]; then
+    echo "Broken patches:"
+    for p in "${FAIL_PATCHES[@]}"; do echo "  - $p"; done
+    echo ""
+fi
+
+rm -rf "$TMPDIR"
+
+if [ $FAIL_COUNT -gt 0 ]; then
+    exit 1
+fi
+exit 0