3d1dc59f4d
Update cookbook fetch.rs for protected recipe handling and atomic patch application. Update config.mk, device services, and legacy base configs. Add patch-inclusion-gate script. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>