cursa: build sd-card image with secret injection

`clan machines build cursa --format sd-card` failed in clan-cli's
post-build secret injection:

  Expected directory /nix/store/...-nixos-image-sd-card-...img.zst/sd-card not found in build output

clan-cli assumed $out/<format>/ (only true for iso; sd-card writes
$out/sd-image/) and tried to inject into every format although only iso
has an addFilesScript. Fixed upstream in
patches/upstream-sd-card-secret-injection.patch (pending PR); until it
lands:

- shell.nix: apply patches/clan-cli-image-filepath.patch (the clan-cli
  part of the upstream change) to the devshell's clan-cli.
- modules/nixos/sd-card-image.nix: local copy of the upstream
  clan.core.image.sd-card.addFilesScript module. Writes the vars tree
  directly into the ext4 root partition with debugfs (no boot-time
  hook), verifies with cmp + e2fsck. Delete once clan-core ships it.
- cursa imports it and builds its sd-card image without disko.

shell.nix

@@ -9,7 +9,15 @@
       devshells.default = {
         devshell = {
           packages = [
-            inputs.clan-core.packages.${system}.clan-cli
+            # Local fix until upstream lands (patches/upstream-sd-card-secret-injection.patch):
+            # `clan machines build --format sd-card` resolves the image via
+            # image.filePath, skips secret injection for formats without
+            # clan.core.image.<format>.addFilesScript, and stages the
+            # injected tree apart from the sandbox output. The sd-card
+            # addFilesScript itself is modules/nixos/sd-card-image.nix.
+            (inputs.clan-core.packages.${system}.clan-cli.overrideAttrs (old: {
+              patches = (old.patches or [ ]) ++ [ ./patches/clan-cli-image-filepath.patch ];
+            }))
           ];
         };
       };