feat: recipe durability guard — prevents build system from deleting local recipes

Add guard-recipes.sh with four modes:
- --verify: check all local/recipes have correct symlinks into recipes/
- --fix: repair broken symlinks (run before builds)
- --save-all: snapshot all recipe.toml into local/recipes/
- --restore: recreate all symlinks from local/recipes/ (run after sync-upstream)

Wired into apply-patches.sh (post-patch) and sync-upstream.sh (post-sync).
This prevents the build system from deleting recipe files during
cargo cook, make distclean, or upstream source refresh.

local/recipes/system/firmware-loader/source/Cargo.toml

@@ -9,4 +9,6 @@ syscall = { package = "redox_syscall", version = "0.7", features = ["std"] }
 redox_scheme = { package = "redox-scheme", version = "0.11" }
 libredox = "0.1"
 log = { version = "0.4", features = ["std"] }
+sha2 = "0.10"
 thiserror = "2"
+toml = "0.8"