build: add verified CardputerZero image entry point

[liuhao-1997]

Summary

• add a one-command local full-image build with fixed input manifests, package checksums, xz validation, and full offline verification
• install the locally built Launcher package and preserve a trusted rollback .deb
• apply ExtPort LED permissions on top of the pinned dtoverlays source, while accepting the patch as already present after its upstream merge
• keep LightDM and ADB hotplug disabled by default in the final stage so package maintainer scripts cannot re-enable them later
• verify current and legacy CameraApp package names, final service links, architecture, Launcher version, DT overlay commit, and existing image requirements

Factory sync and conflict resolution

This branch is based on current CardputerZero/pi-gen@554544921c16 (ahead=0, behind=0 before these commits).

The only text conflict during factory synchronization was stage2/05-cardputerzero/01-run.sh. Resolution keeps the upstream DTOVERLAYS_* variables, pinned commit/archive verification, retry behavior, and already-upstreamed DAPM audio fix. It does not restore the old DTOOVERLAYS_* spelling or the obsolete cardputerzero-audio-fixes.patch. The local addition is isolated to cardputerzero-extport-permissions.patch, with forward/reverse checks so the image remains buildable after m5stack/m5stack-linux-dtoverlays#9 merges.

Factory font packages, updated application Release assets, OOBE behavior, and other upstream changes remain intact.

Release dependencies

• fix(cardputerzero): persist ExtPort LED permissions m5stack/m5stack-linux-dtoverlays#9 should merge first for the final clean source pin, although this branch can apply the exact patch to the current 3f6da2e source archive.
• fix: preserve CardputerZero settings and release workflows launcher#140 and its SDK dependency fix(scons): propagate SOURCE_DATE_EPOCH to compilers m5stack/M5Stack_Linux_Libs#11 must merge and publish a new fixed Launcher .deb.
• Before the official cloud image workflow runs, pin APPLAUNCH_DEB_URL, expected version, SHA-256, and the merged dtoverlays 40-character commit. Building this pi-gen branch while those variables still point at the old Release will intentionally not reproduce the local candidate.

Validation

• current local Launcher .deb: 0.6.31+local.c92874968507.wc55886d99c6e, SHA-256 a105579a5ccbbb75535ea5caec2e16d6ec3a40014bd4ace9f7f3628b118a16d3
• one-command build preflight records pi-gen, Launcher, dtoverlays worktree fingerprints and all input package hashes
• stale-container guard was exercised; an old stopped exit-137 container was removed and the current build started from a fresh rootfs rather than using cross-version CONTINUE=1
• full image build and verification are running; fresh-media OOBE, cold-start, display, audio, input, ADB, ExtPort, camera, and performance checks remain required before release