kernel-build: apply patches outside the checkout + fail-loud sentinel (#1)

The kernel-build job set WORK inside the repo checkout, so build-kernel.sh's
`git apply` ran from a subdirectory of the warden-sdk git repo — where git apply
silently ignores out-of-subdir paths and exits 0 without applying anything. The
build then failed at the (never-created) rv1106-warden.dtb target, and the
unconditional `echo "applied"` had masked it.

- ci.yml: WORK -> ${{ runner.temp }}/kbuild-out (outside the checkout); artifact
  paths follow.
- build-kernel.sh: the patch loop now fails loudly instead of echoing on silent
  failure, and a post-apply sentinel assert (rv1106-warden.dts must exist) makes a
  silent no-op impossible to ship — the regression guard for this class.

Refs #1.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017wB8KB3MMQztRDXCMCkPrf

.github/workflows/ci.yml

@@ -125,7 +125,10 @@ jobs:
           echo "$RUNNER_TEMP/bin" >> "$GITHUB_PATH"
       - name: build zImage + rv1106-warden.dtb
         env:
-          WORK: ${{ github.workspace }}/kbuild-out
+          # WORK must be OUTSIDE the repo checkout: build-kernel.sh applies the patch
+          # series with `git apply`, which silently ignores out-of-subdir paths when
+          # run inside another git repo (issue #1). $RUNNER_TEMP is outside the checkout.
+          WORK: ${{ runner.temp }}/kbuild-out
           JOBS: 4   # belt-and-braces bound in addition to the runner's cgroup cap
           # The kernel is freestanding; use the stable generic arm cross toolchain
           # (Debian gcc-arm-linux-gnueabihf on the runner) rather than depending on
@@ -136,8 +139,8 @@ jobs:
         with:
           name: kernel-rv1106
           path: |
-            ${{ github.workspace }}/kbuild-out/linux-6.18.46/arch/arm/boot/zImage
-            ${{ github.workspace }}/kbuild-out/linux-6.18.46/arch/arm/boot/dts/rockchip/rv1106-warden.dtb
+            ${{ runner.temp }}/kbuild-out/linux-6.18.46/arch/arm/boot/zImage
+            ${{ runner.temp }}/kbuild-out/linux-6.18.46/arch/arm/boot/dts/rockchip/rv1106-warden.dtb
           retention-days: 14
 
   badges: