ci: pin submodule to upstream base and apply patches at build time

The submodule had been pointing at a local MeshCore commit that included
all 5 patches applied on top of upstream. That commit only exists in the
local working tree — CI's `submodules: recursive` checkout couldn't
fetch it from github.com/meshcore-dev/MeshCore and failed with
"fatal: not our ref d2ad3ac8".

Resets vendor/MeshCore to upstream main (910b1bee, the same base our
patches were authored against) so CI can fetch it normally, and adds an
explicit `apply-patches.sh` step to the firmware-build workflow before
the verify and build steps run. The release workflow already applies
patches explicitly so no change there.

Subsequent verify/build steps set MESHCORE_SKIP_APPLY_PATCHES=1 to avoid
re-applying patches on the now-dirty tree.

.github/workflows/firmware-build.yml

@@ -40,8 +40,11 @@ jobs:
       - name: Install PlatformIO
         run: python3 -m pip install --upgrade platformio
 
+      - name: Apply MeshCore patches
+        run: bash scripts/apply-patches.sh
+
       - name: Run host tests and safety checks
-        run: bash scripts/verify.sh --no-build
+        run: MESHCORE_SKIP_APPLY_PATCHES=1 bash scripts/verify.sh --no-build
 
       - name: Build representative firmware
         run: |