turny: fix SPI/GPIO config for newer kernels

- Add complete config.txt settings with u-boot boot lines + spi=on
- Override sdImage.populateFirmwareCommands to use configtxt module output
- Mount firmware partition and add activation script to sync config.txt
- Load spi_bcm2835 and bcm2835_gpiomem kernel modules
- Add udev rule for gpiomem subsystem (not just gpio)
- Relax ProtectKernelTunables so service can access GPIO
- Update turny flake input to rppal-based CS pin fix

secrets/everii-vpn/ch1.key.age

@@ -1,10 +1,9 @@
 age-encryption.org/v1
--> ssh-ed25519 osOCZA ynIsrUjxXEYLRtKoiyBKCn83JeZ5rFhGD3xi61ypVBc
-ZuKEpntuTCMigOf/jeQ3V6oklmqzuxyDpi4oVhtWsc4
--> ssh-ed25519 DFiohQ /0VJWz6hK+0FNjBciDbPHX+ader97UxCiQYB1BFZh3E
-SiqY0KS5wBWHMgEbJMAU1WgvXqEJjBAOQ3l/eMuETdI
--> ssh-ed25519 hRPDBg KSXXiPwj27sKoXMiwW7IqQJvE72lYIgUjiPnpvVSSmE
-ioQGtUPSMj4flm9j84PLGm4C/P0sHVmYX38SgB6Yl2c
---- jUadITulpzJjYp3oWxkG0Qk5RwDXisrKgmXYMlcxCss
-ç[ ,J"ø$¥Èµå½Mõ.ã0ט½Œcë§~ã,�CŸ
-‰“s•¤×u1�™órDTf­:FtwAÉtÿ„™hE¿›„Af
+-> ssh-ed25519 osOCZA q6tH0FVLeK0IAAlBAQfpQJScvePOK3+TSZ38NAfQHWo
+63rJwFLyI3TRkjR8j7Ek4ELE4Se+alHCl1tO5ujmzMA
+-> ssh-ed25519 DFiohQ fc1aSau4DbXn8XzqgAFYbgw1T3U3IMva/RpUTqlBR2Y
+G+qY9wIDOvyOWmQnNmnaasdlFVUGR6cBWpK2Zce5LHM
+-> ssh-ed25519 hRPDBg FT7EbwtMJF9hjfcCc2PqWmRoYYFWkCvQ06DbVfpOg1Y
+8j8Rwfmu+tckffMKMQ0h3/un09mUCi7/hymgqjSNz8U
+--- C03Wle22666W4khdQVHeC9eP+ZJ8AcP3dB+jfCHpeP0
+öÚ†µi•lÎ|G~¸­DUô2í¶�åÐóä"׆ÎÁ¸}j,Ì\|w,°–0ÜO5�ζ¹?~•"ÊÃÖy»fl¢nËõÍÆT