fix: build system hardening — 3 fixes for clean redbear-mini build

apply-patches.sh: 005-qtbase signature now checks correct path
(recipes/wip/qt/qtbase, not recipes/libs/qtbase) and respects
local recipe override. Qt is desktop-only (redbear-full target).

check-fork-drift.sh: skip diverged forks (kernel, bootloader, installer)
to suppress spurious DRIFT warnings. These forks intentionally diverge
from upstream per fork-upstream-map.toml.

integrate-redbear.sh: add safety guard — refuse to symlink any path
ending in 'recipe.toml'. 185 local recipe.toml files were corrupted
into broken self-referencing symlinks by an earlier build session.
All restored from git. Guard prevents reoccurrence.

local/scripts/integrate-redbear.sh

@@ -72,6 +72,12 @@ symlink() {
     local link="$2"
     local current=""
 
+    # Safety: never operate on recipe.toml files (they are tracked, not symlinks)
+    if [[ "$link" == *recipe.toml ]]; then
+        warn "Refusing to symlink recipe.toml: $link"
+        return 1
+    fi
+
     require_real_parent_dirs "$link"
 
     mkdir -p "$(dirname "$link")"