turny: fix SPI/GPIO config for newer kernels

- Add complete config.txt settings with u-boot boot lines + spi=on
- Override sdImage.populateFirmwareCommands to use configtxt module output
- Mount firmware partition and add activation script to sync config.txt
- Load spi_bcm2835 and bcm2835_gpiomem kernel modules
- Add udev rule for gpiomem subsystem (not just gpio)
- Relax ProtectKernelTunables so service can access GPIO
- Update turny flake input to rppal-based CS pin fix

secrets/invidious-companion.age

@@ -1,12 +1,11 @@
 age-encryption.org/v1
--> ssh-ed25519 osOCZA 9wZ3G4vjwJhYungj/utZ/jgnQRD7qGHsMXM51gNFLyY
-SvdeK7R1AxveXXFJng21JK1fy+y7lh6OINB4CtUdS1Q
--> ssh-ed25519 DFiohQ 1NIsoZWR4fY+bcROkw7iq+X0cYIE9g5IiWOqO0FvymQ
-igfAuxzfUSlhE3jaTMjqCYeF8ccKVyuUW+uD8JdH75c
--> ssh-ed25519 wU682A g5y8TFpeJ0myejb8r7gL96JBk/q21KlDOBE6ZpCqv2A
-I/3aFKq2ne3gVeg+/1LmlKoDyg723yyjUdVdzgFzhV4
---- JsRdNjJ285V+RGktIxJv29Alef95kpB2TOnYH66Wr4Q
-z¿
-n
-–´²xÇ‘␍Û¸"‹KA›
x)ñÑ8 é…
-bçµ.)9„è#Š?ØxÔfMW/<Òîy•	ÔHÜçݶOøš
+-> ssh-ed25519 osOCZA MFFVCO90Gx4QdHymLlxU4yjRdJr3JQR1Bvvjz57+D34
+xgGfp/ECiRGiWyp8sAjriHvy9b7GsiHQMCKYVHl1CSA
+-> ssh-ed25519 DFiohQ A5iL8qI5AcaXUmpplE5J0xQIWAryxM1E82VwWc2DhGo
+1dv2EqTkz6Z4HswQOYU5Q79Be0GZvc4HUyyqHWthtPk
+-> ssh-ed25519 wU682A qPkbSVvvQKJI0wcw7syZfKl7ZxTQpZdCwyT4CwjnbFw
+eT/8Z3Ei3/1oi0MEuqiBN/e9Rg8r3zRlUm3vtigl8cE
+--- 3hc/9smt2J3sIJLMDC/QByjE8bqlcNjR7FE9NBgOQp8
+¾>IÑY
+7wgö
¼
+;ÏÇyî,øpå43@B3F‚;k(¼\ÊN&àÔÿÑÇý4Q•8Iúž‡MÿÁg!ÃîÜÚ£³