kernel-build: apply patches outside the checkout + fail-loud sentinel (#1)

The kernel-build job set WORK inside the repo checkout, so build-kernel.sh's
`git apply` ran from a subdirectory of the warden-sdk git repo — where git apply
silently ignores out-of-subdir paths and exits 0 without applying anything. The
build then failed at the (never-created) rv1106-warden.dtb target, and the
unconditional `echo "applied"` had masked it.

- ci.yml: WORK -> ${{ runner.temp }}/kbuild-out (outside the checkout); artifact
  paths follow.
- build-kernel.sh: the patch loop now fails loudly instead of echoing on silent
  failure, and a post-apply sentinel assert (rv1106-warden.dts must exist) makes a
  silent no-op impossible to ship — the regression guard for this class.

Refs #1.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017wB8KB3MMQztRDXCMCkPrf

build/build-kernel.sh

@@ -66,14 +66,34 @@ rm -rf "$SRC"
 log "extracting pristine"
 tar -C "$WORK" -xf "$TB"
 
-# 3. apply the patch series in order
+# 3. apply the patch series in order (fail loudly — never echo a lie)
 log "applying patch series"
 for p in "$PATCHES"/*.patch; do
-  git -C "$SRC" apply --whitespace=nowarn "$p" 2>/dev/null \
-    || patch -d "$SRC" -p1 --no-backup-if-mismatch < "$p"
+  if git -C "$SRC" apply --whitespace=nowarn "$p" 2>/dev/null; then
+    :
+  elif patch -d "$SRC" -p1 --forward --no-backup-if-mismatch < "$p" >/dev/null 2>&1; then
+    :
+  else
+    echo "FATAL: failed to apply $(basename "$p")" >&2
+    exit 1
+  fi
   echo "  applied $(basename "$p")"
 done
 
+# Guard against a SILENT no-op: `git apply` run from inside another git repo's
+# subdirectory ignores out-of-subdir paths and exits 0 without applying anything
+# (issue #1). $WORK must therefore live OUTSIDE any git checkout. Assert that a known
+# product of the series actually landed on disk, so this can never masquerade as
+# success again.
+SENTINEL="$SRC/arch/arm/boot/dts/rockchip/rv1106-warden.dts"
+[ -f "$SENTINEL" ] || {
+  echo "FATAL: patch series did not apply (missing $SENTINEL)." >&2
+  echo "       Is \$WORK inside a git repo? git apply silently ignores out-of-subdir" >&2
+  echo "       paths there — point WORK at a dir outside any checkout (e.g. \$RUNNER_TEMP)." >&2
+  exit 1
+}
+log "patch series applied ($(basename "$SENTINEL") present)"
+
 # 4. configure
 log "configuring (warden_defconfig)"
 cp "$HERE/warden_defconfig" "$SRC/.config"