fix(build): remove dangling base/redox.patch symlink + policy doc

The build was failing at verify-overlay-integrity.sh with:

  ERROR: dangling patch symlink: recipes/core/base/redox.patch -> .../local/patches/base/redox.patch
  ERROR: missing critical patch: local/patches/base/redox.patch

The mega-patch (100MB+) was gitignored and got lost, while the
dangling symlink at recipes/core/base/ is leftover infrastructure.

The base recipe (recipes/core/base/recipe.toml) does NOT reference
redox.patch - it uses individual P*.patch files (P0-P9). The mega-patch
was abandoned 2026-04-30 in favor of ~100 individual patches.

Changes:
- Remove dangling recipes/core/base/redox.patch symlink
- Update verify-overlay-integrity.sh to drop obsolete references
  (redox.patch in base) and consolidate redbear-live-full into the
  current critical configs list
- Remove 'local/patches/base/redox.patch' from .gitignore (it is gone
  for good; never resurrect the mega-patch approach)
- Document NEVER-GITIGNORE-CRITICAL-INFRASTRUCTURE policy in AGENTS.md
  (replaces the obsolete 'Large Patch Files' section that described
  the now-removed chunks/reassembly approach)
- Add Linux reference tree migration note (2.1GB tree should eventually
  be tracked via sparse submodule or gitea mirror)

.gitignore

@@ -92,6 +92,5 @@ local/recipes/kde/kwin/**
 !local/recipes/kde/kwin/README.md
 Packages/*.pkgar
 local/cache/pkgar/
-local/patches/base/redox.patch
 local/reference/
 local/recipes/qt/qtbase/source/

AGENTS.md

@@ -209,14 +209,23 @@ cross-referencing driver behavior, hardware initialization sequences, register d
 and error handling patterns.
 
 **Rules:**
-- **NEVER delete** the reference tree. It is gitignored but permanent.
+- **NEVER delete** the reference tree.
 - **ALWAYS consult** the Linux source when building or fixing drivers, daemons, or any subsystem
   that has a Linux counterpart (audio/HDA, GPU/DRM, networking, USB, PCI, ACPI, input, storage,
   filesystems, scheduler, memory management).
 - **Update** the reference tree when a new stable Linux version is needed:
   `git -C local/reference/linux-7.0 fetch --depth=1 origin tag:v7.x --force`
 - The reference tree is read-only for consultation purposes. No modifications.
-- Location: `local/reference/` is gitignored. It survives `make clean` and `make distclean`.
+- Location: `local/reference/` survives `make clean` and `make distclean`.
+
+**Tracking policy:** The Linux reference tree is currently gitignored (2.1GB).
+Per our **NEVER GITIGNORE CRITICAL INFRASTRUCTURE** policy, it should eventually
+be migrated to either:
+- A sparse git submodule reference (only top-level + needed subdirs), or
+- A periodic mirror on the gitea server that CI re-clones when needed.
+
+This is a follow-up refactor — the tree is permanent, just currently gitignored
+by size. The `local/reference/` directory is **NOT** optional.
 
 ## DURABILITY POLICY
 
@@ -328,14 +337,27 @@ patches must be respected:
 
 When reordering patches: remove the source tree, re-fetch, and rebuild to verify.
 
-### Large Patch Files (redox.patch)
+### Large Patch Files
 
-`local/patches/base/redox.patch` (consolidated mega-patch) exceeds GitHub's
-100 MB file size limit. It is stored as 90 MB chunks under
-`local/patches/base/redox-patch-chunks/` and reassembled by:
-```bash
-local/patches/base/reassemble-redox-patch.sh
-```
+**POLICY: Never gitignore critical build infrastructure, regardless of file size.**
+
+The Gitea server is our own — we have unlimited space. Do not put `local/patches/*`,
+`local/recipes/*`, or any other durable Red Bear code in `.gitignore` because of file size.
+
+**Historical context (resolved):** The original `local/patches/base/redox.patch` was a 100MB+
+consolidated mega-patch that was placed in `.gitignore`. After it was lost, base
+recipe could not be built from a clean checkout. The mega-patch approach was
+abandoned in favor of ~100 individual `P*.patch` files (totaling 2.4MB) that are
+all committed to git.
+
+**Current state:** All `local/patches/base/P*.patch` files are tracked in git.
+The dangling `recipes/core/base/redox.patch` symlink (the old mega-patch
+shortcut) has been removed because the base recipe uses individual `P*.patch`
+entries directly, not the mega-patch.
+
+**Future policy:** If a single patch ever grows beyond what Git LFS would
+comfortably handle, split it into multiple smaller patches. Do not put it in
+`.gitignore`. Do not store it in chunks that need reassembly.
 
 ### Patch Governance
 

local/scripts/verify-overlay-integrity.sh

@@ -103,7 +103,6 @@ BROKEN_PATCH_SYMLINKS=0
 
 EXPECTED_PATCH_SYMLINKS=(
     "recipes/core/kernel/redox.patch"
-    "recipes/core/base/redox.patch"
     "recipes/core/base/P2-boot-runtime-fixes.patch"
     "recipes/core/relibc/redox.patch"
     "recipes/core/installer/redox.patch"
@@ -137,7 +136,6 @@ log "    $PATCH_SYMLINK_COUNT patch symlinks checked, $BROKEN_PATCH_SYMLINKS bro
 log "==> Checking critical local/patches/ files..."
 CRITICAL_PATCHES=(
     "local/patches/kernel/redox.patch"
-    "local/patches/base/redox.patch"
     "local/patches/relibc/redox.patch"
     "local/patches/installer/redox.patch"
     "local/patches/bootloader/redox.patch"
@@ -163,15 +161,15 @@ fi
 log "==> Checking config/redbear-*.toml files..."
 CRITICAL_CONFIGS=(
     "config/redbear-full.toml"
-    "config/redbear-live-full.toml"
-    "config/redbear-minimal.toml"
-    "config/redbear-live-minimal.toml"
-    "config/redbear-desktop.toml"
+    "config/redbear-mini.toml"
+    "config/redbear-grub.toml"
     "config/redbear-device-services.toml"
     "config/redbear-legacy-base.toml"
     "config/redbear-legacy-desktop.toml"
     "config/redbear-netctl.toml"
     "config/redbear-greeter-services.toml"
+    "config/redbear-grub-policy.toml"
+    "config/redbear-bluetooth-services.toml"
 )
 
 MISSING_CONFIGS=0