turny: fix SPI/GPIO config for newer kernels

- Add complete config.txt settings with u-boot boot lines + spi=on
- Override sdImage.populateFirmwareCommands to use configtxt module output
- Mount firmware partition and add activation script to sync config.txt
- Load spi_bcm2835 and bcm2835_gpiomem kernel modules
- Add udev rule for gpiomem subsystem (not just gpio)
- Relax ProtectKernelTunables so service can access GPIO
- Update turny flake input to rppal-based CS pin fix

AGENTS.md

@@ -8,7 +8,7 @@
 - `nix build .#nixosConfigurations.<host>.config.system.build.toplevel` - Build specific host
 
 ## Code Style
-- **Format**: Use `nixfmt-rfc-style` for all .nix files
+- **Format**: Use `nixfmt` for all .nix files
 - **Imports**: List imports first, group by: local modules, external inputs (inputs.*)
 - **Function args**: Multi-line with trailing comma when >3 args: `{ config, lib, pkgs, ... }:`
 - **Options**: Define in `options.<service>` block, implement in `config = lib.mkIf cfg.enable { ... }`