Pin bmax121/KernelPatch (incl. its recent 4.14 kallsyms fix) under kmod/third_party/. Makefile defaults KP_DIR to the submodule, so `make kpm` works out of the box (after submodule init) and CI can build the .kpm reproducibly.