feat: recipe durability guard — prevents build system from deleting local recipes

Add guard-recipes.sh with four modes:
- --verify: check all local/recipes have correct symlinks into recipes/
- --fix: repair broken symlinks (run before builds)
- --save-all: snapshot all recipe.toml into local/recipes/
- --restore: recreate all symlinks from local/recipes/ (run after sync-upstream)

Wired into apply-patches.sh (post-patch) and sync-upstream.sh (post-sync).
This prevents the build system from deleting recipe files during
cargo cook, make distclean, or upstream source refresh.

local/recipes/system/driver-manager/src/exec.rs

@@ -0,0 +1,18 @@
+use std::process::Command;
+
+#[allow(dead_code)]
+pub fn spawn_driver(command: &[String]) -> Result<std::process::Child, std::io::Error> {
+    if command.is_empty() {
+        return Err(std::io::Error::new(
+            std::io::ErrorKind::InvalidInput,
+            "empty command",
+        ));
+    }
+
+    let mut cmd = Command::new(&command[0]);
+    for arg in &command[1..] {
+        cmd.arg(arg);
+    }
+
+    cmd.spawn()
+}