turny: fix SPI/GPIO config for newer kernels

- Add complete config.txt settings with u-boot boot lines + spi=on
- Override sdImage.populateFirmwareCommands to use configtxt module output
- Mount firmware partition and add activation script to sync config.txt
- Load spi_bcm2835 and bcm2835_gpiomem kernel modules
- Add udev rule for gpiomem subsystem (not just gpio)
- Relax ProtectKernelTunables so service can access GPIO
- Update turny flake input to rppal-based CS pin fix

secrets/actual.age

@@ -1,10 +1,9 @@
 age-encryption.org/v1
--> ssh-ed25519 osOCZA n8TUqlE5mEfKa7aPdefBjIKAhydL1vrCZK8cLTs+j3w
-ayrirgnGn6dTBKShBRDHJAI3t040hf5LEo8ZuHUGNHg
--> ssh-ed25519 DFiohQ +rVCacN11divc55NH2fKsYXa6IJ0ieW18riYz9nkrwo
-4qv06+QnvPKYRRkQauDwKfnT1c4/GHDkxHVrgkfrHNw
--> ssh-ed25519 PT7ffg wklac2cEzzfMQaItzsAv6I1az8HxZ15s3ANwxYO59To
-abdf65f0BT2sE52T60lnfqY/iDCgLAzgRQlPqjRp6Y4
---- Wi4+L0OzsduT8T7G4+H8pp05EzbTjNlJowwBDWUN1mU
-ÛŸþfŽ¹“Íå¸ÁºTL®›`‚ý¬—F„F»‡í$S1†ºqÐv3nÙOu‰Xªf␍AþÂn‡e’¥Sý©ªEãM_¿	ï^VÀŽ‘ä4p.øäBIO¹Ô÷
-Bñ`�Œsï)Z4œÜHŸßRvÓ/MÓÕ->	5òÓå	îµ²⢃;ü~¹÷ÿ
+-> ssh-ed25519 osOCZA tKc6OuybMhchwMgREDpacwxz/IlBCOOD9OQp/UMLBys
+7mOmTzMUnLYnQPHOWwIiZ4vFyPxQpwzPmnQMuWsQWfA
+-> ssh-ed25519 DFiohQ +ysb8W20OD73awl7we7/XfiX5q8sRtMlerr5r4gavTA
+5OHmlJHoVRXho2Swe/XDTtQKn0pW9PH1Ky4rvhR7o/8
+-> ssh-ed25519 PT7ffg 0vvEHkjNJFH/UUcwX8O+F0StVBqNkQNp7u2qasHZLCE
+xKySMrX3T59dCKEUHyR/cdT+8KCFdCerUyUg7r7ZBYQ
+--- ielXPF0xxxqSrBc1yeOxLdz50ZjCLnZJ45Wsg84yPso
+×S;ëqø»äá û˜…Å@ðŒ±S,a¾¬ÛÜH3;(¥¡%o#‘ýx$Qgw”žãÊ>ô�ias °ù»%fjr¼ÊÜ^cïrô©´Ñ‚â°`ä—e›¼níû_�–w›×¶çõvÓCØŇx}|µFnÿjݹ°²À­ ß