test: add cached patch matrix coverage.

[artemdinaburg]

Summary

• add a cached patch and contract matrix runner that reuses firmware outputs and generated fixtures locally
• cover both positive and expected-failure transform scenarios, including static contract lowering checks
• make Docker-backed helper scripts safer for Buildx state and Docker-in-Docker path translation, and wire the matrix into CI

Test Plan

• bash ./scripts/test-patch-matrix.sh --build-type Debug --report-prefix codex-matrix-final
• bash ./scripts/test-patch-matrix.sh --build-type Debug --report-prefix codex-matrix-negative
• ctest --preset debug -R patchir-transform-tests --output-on-failure
• shellcheck firmwares/build.sh scripts/ghidra/build-headless-docker.sh scripts/test-patch-matrix.sh