Makefile: add verify-patches, verify-file-patches, verify-all targets

Improvement C: explicit verification targets for the
build system. The user requested 'build system must
report complete when upstream have our patches applied'.

* make verify-patches
  Runs check-cargo-patches.sh — verifies all [patch.crates-io]
  and [patch.'<URL>'] sections in local sources'
  Cargo.toml files resolve to the expected local fork
  paths. Returns non-zero on any unresolved patch.

* make verify-file-patches
  Runs check-unwired-patches.sh --strict — verifies
  all file-level .patch files in local/patches/ are
  referenced by at least one recipe.toml patches = [...]
  entry. Returns non-zero on any unwired patch.

* make verify-all
  Runs both. This is the comprehensive Phase J end-to-end
  verification.

The cookbook itself already logs [SUMMARY] All N patches
validated successfully for file-level patches. These
new Makefile targets make the verification part of the
standard build workflow.

Makefile

@@ -44,6 +44,21 @@ cache-save-essential:
 cache-verify:
 	@bash $(CACHE_RESTORE) --verify
 
+# Phase J / Improvement C: verify that all Cargo [patch]
+# sections in the local sources' Cargo.toml files resolve
+# to the expected local fork paths. Run after `make all`
+# to confirm Phase J end-to-end. Returns non-zero exit on
+# any unresolved patch.
+verify-patches:
+	@bash local/scripts/check-cargo-patches.sh
+
+# Phase I: also run the file-level patch check
+verify-file-patches:
+	@bash local/scripts/check-unwired-patches.sh --strict
+
+# Verify everything: file-level patches + Cargo [patch] sections
+verify-all: verify-file-patches verify-patches
+
 cache-list:
 	@bash $(CACHE_SAVE) --list