fix: update build system tooling and configuration

Update cookbook fetch.rs for protected recipe handling and atomic
patch application. Update config.mk, device services, and legacy
base configs. Add patch-inclusion-gate script.

local/scripts/integrate-redbear.sh

@@ -256,8 +256,8 @@ for component in "${!PATCH_COMPONENT_TO_RECIPE[@]}"; do
 
     patch_dir="local/patches/${component}"
 
-    # Collect all .patch files from both the component dir and absorbed/ subdir.
-    find "$patch_dir" -maxdepth 2 -name "*.patch" -type f 2>/dev/null | while read patch_file; do
+    # Collect all .patch files from the component dir (skip absorbed/ subdirs).
+    find "$patch_dir" -maxdepth 1 -name "*.patch" -type f 2>/dev/null | while read patch_file; do
         patch_name="$(basename "$patch_file")"
 
         # Resolve the relative path from recipe dir to patch file.
@@ -347,7 +347,7 @@ if [ "${#staged_firmware[@]}" -gt 0 ]; then
 fi
 
 if [ "${#firmware_blobs[@]}" -gt 0 ]; then
-    cp "${firmware_blobs[@]}" "local/recipes/system/firmware-loader/source/firmware/amdgpu/"
+    cp -f "${firmware_blobs[@]}" "local/recipes/system/firmware-loader/source/firmware/amdgpu/"
     status "Staged ${#firmware_blobs[@]} AMD firmware blob(s)"
 else
     warn "Skipping firmware staging because no AMD firmware blobs were found"