build-redbear: stale-build prevention via source-pkgar commit comparison

Automatically detects when source repos (relibc, kernel, base,
bootloader, installer) have commits newer than their built pkgars.
If stale, forces a clean rebuild to prevent shipping old binaries.

Also: consolidated clean-rebuild logic into a single conditional.

local/scripts/build-redbear.sh

@@ -176,6 +176,41 @@ fi
 echo ">>> Building Red Bear OS with config: $CONFIG"
 echo ">>> This may take 30-60 minutes on first build..."
 
+# Stale-build prevention: if any source repo has commits newer than its
+# pkgar, force a clean rebuild. This prevents the cookbook from using
+# cached packages with stale binaries.
+if [ "$CLEAN" != "--no-cache" ]; then
+    for src in relibc kernel base bootloader installer; do
+        src_dir="$PROJECT_ROOT/local/sources/$src"
+        pkgar="$PROJECT_ROOT/repo/x86_64-unknown-redox/$src.pkgar"
+        if [ -d "$src_dir/.git" ] && [ -f "$pkgar" ]; then
+            src_commit=$(git -C "$src_dir" rev-parse HEAD 2>/dev/null || echo "")
+            pkgar_commit=$(python3 -c "
+import tomllib
+try:
+    with open('$pkgar'.replace('.pkgar','.toml'),'rb') as f:
+        d = tomllib.load(f)
+    print(d.get('commit_identifier',''))
+except: pass
+" 2>/dev/null || echo "")
+            if [ -n "$src_commit" ] && [ "$src_commit" != "$pkgar_commit" ] && [ -n "$pkgar_commit" ]; then
+                echo ">>> Stale $src detected (source newer than pkgar), force-rebuilding..."
+                rm -f "$PROJECT_ROOT/repo/x86_64-unknown-redox/$src".*
+                find "$PROJECT_ROOT/recipes" -path "*/$src/target" -type d -exec rm -rf {} + 2>/dev/null || true
+                CLEAN="--no-cache"
+            fi
+        fi
+    done
+fi
+
+if [ "$CLEAN" = "--no-cache" ]; then
+    echo ">>> Cleaning repo and recipe caches for clean build..."
+    make repo_clean 2>/dev/null || true
+    rm -rf "$PROJECT_ROOT"/repo
+    find "$PROJECT_ROOT"/local/recipes -maxdepth 4 -name "target" -type d -exec rm -rf {} + 2>/dev/null || true
+    find "$PROJECT_ROOT"/recipes -maxdepth 3 -name "target" -type d -exec rm -rf {} + 2>/dev/null || true
+fi
+
 if [ -n "${REDBEAR_RELEASE:-}" ]; then
     bash "$PROJECT_ROOT/local/scripts/build-release-mode.sh" --release="$REDBEAR_RELEASE" --config="$CONFIG" --extra-package=relibc
 fi