build system: fix 3 more silent-failure bugs in the baked-shim port path

Found by extending the edge-case suite to the baked-shim path (E17-E19) after a
sync reported 'ready' but silently dropped a module's Redox shim:
 - git show used an ABSOLUTE recipe path ('HEAD:/mnt/.../source/f') which git
   rejects (needs repo-relative) -> empty content -> garbage delta. Now uses
   ${dir#$ROOT/}.
 - diff|patch under 'set -o pipefail': diff exits 1 whenever files differ (always
   here), so the pipeline looked failed even when patch succeeded -> EVERY shim
   false-rejected. Now captures the delta to a file and checks patch's own exit.
 - a shim whose file was renamed/removed upstream, or unreadable from HEAD, was
   silently skipped. Now: Redox-added files are carried in verbatim; a missing
   target or unreadable HEAD file -> SHIM-REJECT (manual), never a silent drop.
Also: old-version URL derivation now rewrites the major.minor dir component too
(KDE mirrors nest tarballs under .../6.28/foo-6.28.0). CI branch glob widened to
[0-9]* so 0.4.0/0.5.0 release branches keep triggering.

.github/workflows/redbear-ci.yml

@@ -2,10 +2,11 @@ name: redbear-ci
 
 on:
   push:
-    # Glob so a release-branch increment (0.3.1 -> 0.3.2 -> ...) keeps triggering
-    # CI — including the versioning-machinery checks below — without editing this
-    # file on every bump.
-    branches: ["0.3.*", master]
+    # Any version-like release branch (0.3.1, 0.3.2, 0.4.0, 0.5.0, 1.0.0, ...)
+    # keeps triggering CI — including the versioning-machinery checks below —
+    # without editing this file on every bump. Release branches start with a
+    # digit; master is listed explicitly.
+    branches: ["[0-9]*", master]
   pull_request:
 
 jobs: