turny: fix SPI/GPIO config for newer kernels

- Add complete config.txt settings with u-boot boot lines + spi=on
- Override sdImage.populateFirmwareCommands to use configtxt module output
- Mount firmware partition and add activation script to sync config.txt
- Load spi_bcm2835 and bcm2835_gpiomem kernel modules
- Add udev rule for gpiomem subsystem (not just gpio)
- Relax ProtectKernelTunables so service can access GPIO
- Update turny flake input to rppal-based CS pin fix

secrets/context7.age

@@ -1,9 +1,9 @@
 age-encryption.org/v1
--> ssh-ed25519 osOCZA 9ZHiyWiFLySuINTKXSjysD9u7LKyhK2bJo6JmVskDGc
-IDUB5fbYwEwZDIRwOAAWdDkHOrmMwlZT+2UhObhHVXg
--> ssh-ed25519 DFiohQ OFE+xiH2zIXccj3axHbN8TBKS927ldBtlC80ZCVH2To
-E50Dr6cyllIN66QVGYvonpSRV0nERdstsEGUeXrVDoE
--> ssh-ed25519 hRPDBg Z9ItEkrFay5918/EY2RCl0a9PZx3z8amW4yMyfgEqQI
-rEs5eqfdnpwnxzPRlMi1vBrtzsbQCwCupkGEXFs7rVA
---- op5RVwxhxkxflXvoAM7ZcEXLutkF9Op70tUxsJundN4
-è$À;Åå1ÒO`bBMÆLŸf“<î”ã%>1p�kvMØ]?x|ù¬zäFƶ~ÖÙÕ¬pL␍
úIÝ(␍u¢ÉDØÈZNž÷ªÏ•Qv˜îŒr88ð¹[²Ãü
+-> ssh-ed25519 osOCZA IY+dU1oe5ps4gli4bqRVdIaKaOWfEieIX0b/8q6+Pys
+L5Bkf3dTH9k0HUYrrTvLq5hvS7CK1nJp1mJumBlVGb8
+-> ssh-ed25519 DFiohQ BjbGXY9CmrAEcv4+hk+A1AIP06NeP4NhymTeByfxi3c
+94qpDg6nEowmkNUzeDGtNw8VgT8vsWR4y28/lMyfZmc
+-> ssh-ed25519 hRPDBg 7Lq1rjiz1FhgFkWaZJaLR24k+HAKLraw9YjVsWPspVE
+3eBnzsN96eLmIlu9MNiBhv41csudd4WQUF5Q9vpGkj0
+--- l10qNh0gcX57lTZsiTsuzwhVGnKM5hH5+ZbjI9yfr/Q
+ûK¿;n},ijæ6uîȧMŤ'ülÿÓÂò–?ÜÜå'„MtÙš.¢ßšžô.I‹Qó³öy)&|=¨½@
1ãmSRD"&&áWUgið}'ˆ¹¶¥�