Harden automation: apply only build patches, default clean, install binaries

scripts/apply-patches.sh

@@ -7,7 +7,7 @@ PATCHDIR="${ROOT}/patches"
 usage() {
   cat <<USAGE
 Usage: $0
-Applies patches/*.patch to the working tree (idempotent).
+Applies patches 0001–0004 to the working tree (idempotent).
 USAGE
 }
 
@@ -23,18 +23,16 @@ if [[ ! -d "$PATCHDIR" ]]; then
   exit 1
 fi
 
-# Apply patches only if they are not already applied.
-# We use --dry-run to test applicability; if it fails, we assume it's already applied.
 shopt -s nullglob
 patches=( "$PATCHDIR"/000[1-4]-*.patch )
-#patches=( "$PATCHDIR"/*.patch )
+
 if (( ${#patches[@]} == 0 )); then
-  echo "ERROR: no patches found in $PATCHDIR" >&2
+  echo "ERROR: no 0001–0004 patches found in $PATCHDIR" >&2
   exit 1
 fi
 
 for p in "${patches[@]}"; do
-  echo "==> Checking $p"
+  echo "==> Checking $(basename "$p")"
   if patch --dry-run -p1 < "$p" >/dev/null 2>&1; then
     echo "==> Applying $(basename "$p")"
     patch -p1 < "$p"