feat: build system hardening — collision detection, validation gates, init path enforcement

5-phase hardening to prevent silent file-layer collisions (the D-Bus
regression class):

Phase 1: lint-config-paths.sh + make lint-config in depends.mk
Phase 2: CollisionTracker in installer (content-hash comparison)
Phase 3: installs manifests in recipe.toml + validate-file-ownership.sh
Phase 4: validate-init-services.sh + make validate in disk.mk
Phase 5: documentation (AGENTS.md, BUILD-SYSTEM-HARDENING-PLAN.md)

Both redbear-mini and redbear-full build and validate clean.
66 declared install paths in base, zero conflicts.

local/AGENTS.md

@@ -611,6 +611,45 @@ local/Assets/
 
 **Current status**: Assets are committed to git. Not yet integrated into the build — requires bootloader and display server integration (P2 hardware validation).
 
+## BUILD SYSTEM SAFETY
+
+The build system includes collision detection and validation to prevent the D-Bus regression
+class (config overrides silently overwritten by package staging).
+
+### Validation Targets
+
+```bash
+make lint-config                       # Check for /usr/lib/init.d/ in config [[files]]
+make validate CONFIG_NAME=redbear-mini # Full validation: lint + init services + ownership
+```
+
+### Init Service Path Convention
+
+- Packages own `/usr/lib/init.d/` — default service files from recipe staging
+- Config overrides own `/etc/init.d/` — override files from `[[files]]` entries
+- Config `[[files]]` MUST NOT use `/usr/lib/init.d/` paths for init services
+- The init system's `config_for_dirs()` gives `/etc/init.d/` priority via BTreeMap dedup
+
+### Collision Detection (installer)
+
+The installer includes `CollisionTracker` (in `collision.rs`) that detects when package
+staging overwrites config pre-install files. Init service collisions always error. Other
+collisions warn by default, error in strict mode (`REDBEAR_STRICT_COLLISION=1`).
+
+### Recipe Installs Manifest
+
+Recipes can declare installed paths via `installs = [...]` in `[package]` section.
+`scripts/validate-file-ownership.sh` checks for conflicts. No recipes declare installs yet.
+
+### Manifest Generation
+
+```bash
+scripts/generate-installs-manifest.sh base  # Output suggested installs for base package
+```
+
+See `local/docs/BUILD-SYSTEM-HARDENING-PLAN.md` for the full 5-phase hardening plan.
+See `local/docs/BUILD-SYSTEM-INVARIANTS.md` for invariants I1-I3.
+
 ## ANTI-PATTERNS
 
 - **DO NOT** edit files under mainline `recipes/` directly — put patches in `local/patches/`