feat: recipe durability guard — prevents build system from deleting local recipes

Add guard-recipes.sh with four modes:
- --verify: check all local/recipes have correct symlinks into recipes/
- --fix: repair broken symlinks (run before builds)
- --save-all: snapshot all recipe.toml into local/recipes/
- --restore: recreate all symlinks from local/recipes/ (run after sync-upstream)

Wired into apply-patches.sh (post-patch) and sync-upstream.sh (post-sync).
This prevents the build system from deleting recipe files during
cargo cook, make distclean, or upstream source refresh.

local/scripts/sync-upstream.sh

@@ -276,6 +276,8 @@ fi
 
 echo ""
 echo "==> Sync complete."
+echo "==> Guarding recipe durability..."
+./local/scripts/guard-recipes.sh --restore 2>/dev/null || echo "   (guard-recipes.sh not found — run manually)"
 echo "    Previous HEAD: $PREV_HEAD"
 echo "    New HEAD:      $(git rev-parse HEAD)"
 echo ""