turny: fix SPI/GPIO config for newer kernels

- Add complete config.txt settings with u-boot boot lines + spi=on
- Override sdImage.populateFirmwareCommands to use configtxt module output
- Mount firmware partition and add activation script to sync config.txt
- Load spi_bcm2835 and bcm2835_gpiomem kernel modules
- Add udev rule for gpiomem subsystem (not just gpio)
- Relax ProtectKernelTunables so service can access GPIO
- Update turny flake input to rppal-based CS pin fix

secrets/dnote.age

@@ -1,9 +1,9 @@
 age-encryption.org/v1
--> ssh-ed25519 osOCZA sWXC8tg44GfsKCFIDhvmkSfO1NnQ/GdP7s7yKnn/wwk
-tulj+EsIi91rXw7XV0elKyVpamDNnEdy1GikcmPGLlE
--> ssh-ed25519 DFiohQ 8Cxy6QZkviBPw51+3m6JYtcOPTbYy6C7m7uomdFwAgY
-4GuwAQKMtKI7cZCg2/yl4IAd98Zeai+/rXScSRRmS9E
--> ssh-ed25519 PT7ffg dnDE79EVRVys94oHOSduzhcyd8oHA8/scK98By5g9FE
-RFfMpq56KDvIJcOg5JdaOiEN6wupKFUNbcHYCS/kyp0
---- Tg+Gw0uAEFItHT00VDs9BmhvX2f8afcRwuh8OSqLEh4
-È*Í�¦ciðÜ~P+c÷{p™“²Û…£yé\©â'a“<x6Xsá¡zógŸ~=´è0
¸–6=sÞ5ÐÆlØ5BŒÎ3ÌÜ5í»š§
+-> ssh-ed25519 osOCZA /DM/QULRCY6cCkuqi0h+PVXW+lFcvUwTaNI4vVHoG3w
+f/U+q+Y6zoIcg0ttN+JgFc0GqXKWV08nmWUeeeC+b5k
+-> ssh-ed25519 DFiohQ kgrVGGqMrBn8W1trnR116ODUHTeDR60BLnWfqANr/QA
+ys8CLK1XHkOQvp3xlcQkQ3me2a2/Nu94o5L9swWhsAs
+-> ssh-ed25519 PT7ffg 3jg8xsvEsjZ8Gzap1Q0T5cZpi/lmk8/DuE1Zsk7ByGY
+gfrFh5M2GWWa+5IaO7yL8LRlMThRWt/XdZIYDXxo8zU
+--- U2Rbi2kHkOIW8AErxfFCUwf2HayX+J4QjKVz/4aGn9k
+¤c	Ý“øÉ�‘ôºœ2kž7ˆÿ)ýí,h~Ó1!¦ÓÁjaÍé`ÊVz Æ-␍n}<ÎغKä+Rrw¿’Wð†Æ®3éCRªòV©yÙ{