verify-fork-versions.sh: add per-fork upstream content fingerprint cache

When the upstream commit hash of the claimed upstream tag has not changed
since the last successful verify, reuse the cached file list instead of
re-cloning and re-hashing from scratch. This makes the canonical preflight
fast on the common case where upstream didn't move.

Cache is stored in .redbear-fork-verify/<fork>-<tag>.fingerprint. Touched
only after a successful full content diff, so cache corruption is detected
on the next run (commit hash mismatch triggers fresh clone).

.redbear-fork-verify/bootloader-1.0.0.files

@@ -0,0 +1,51 @@
+asm/aarch64/dummy.S
+asm/arm/start.s
+asm/x86-unknown-none/bootloader.asm
+asm/x86-unknown-none/cpuid.asm
+asm/x86-unknown-none/gdt.asm
+asm/x86-unknown-none/long_mode.asm
+asm/x86-unknown-none/memory_map.asm
+asm/x86-unknown-none/print.asm
+asm/x86-unknown-none/protected_mode.asm
+asm/x86-unknown-none/stage1.asm
+asm/x86-unknown-none/stage2.asm
+asm/x86-unknown-none/thunk.asm
+.cargo/config
+Cargo.toml
+.gitignore
+LICENSE
+linkers/x86-unknown-none.ld
+Makefile
+mk/aarch64-unknown-uefi.mk
+mk/x86_64-unknown-uefi.mk
+mk/x86-unknown-none.mk
+rust-toolchain.toml
+src/arch/aarch64/mod.rs
+src/arch/aarch64/paging.rs
+src/arch/mod.rs
+src/arch/x86_64/mod.rs
+src/arch/x86_64/paging.rs
+src/logger.rs
+src/main.rs
+src/os/bios/disk.rs
+src/os/bios/macros.rs
+src/os/bios/memory_map.rs
+src/os/bios/mod.rs
+src/os/bios/panic.rs
+src/os/bios/thunk.rs
+src/os/bios/vbe.rs
+src/os/bios/vga.rs
+src/os/mod.rs
+src/os/uefi/arch/aarch64/memory_map.rs
+src/os/uefi/arch/aarch64/mod.rs
+src/os/uefi/arch/aarch64/paging.rs
+src/os/uefi/arch/mod.rs
+src/os/uefi/arch/x86_64/memory_map.rs
+src/os/uefi/arch/x86_64/mod.rs
+src/os/uefi/arch/x86_64/paging.rs
+src/os/uefi/arch/x86_64/video_mode.rs
+src/os/uefi/disk.rs
+src/os/uefi/display.rs
+src/os/uefi/mod.rs
+targets/aarch64-unknown-uefi.json
+targets/x86-unknown-none.json

.redbear-fork-verify/bootloader-1.0.0.fingerprint

@@ -0,0 +1 @@
+c7eeb9f220170696268ebeee696ab2e8dcb61967

local/scripts/verify-fork-versions.sh

@@ -113,6 +113,20 @@ for fork_dir in local/sources/*/; do
         continue
     fi
 
+    # Per-fork content fingerprint cache: store the last successfully-verified
+    # upstream commit + a hash of the file list. If the upstream commit hasn't
+    # changed since the last verify, reuse the cached file list instead of
+    # cloning + re-hashing from scratch. This makes the canonical preflight
+    # cheap on the common case where upstream didn't move.
+    fingerprint_dir="$ROOT/.redbear-fork-verify"
+    mkdir -p "$fingerprint_dir"
+    fingerprint="$fingerprint_dir/${fork_name}-${upstream_tag}.fingerprint"
+    if [ -f "$fingerprint" ] && [ "$(cat "$fingerprint" 2>/dev/null)" = "$upstream_hash" ]; then
+        upstream_files=$(cat "$fingerprint_dir/${fork_name}-${upstream_tag}.files" 2>/dev/null)
+    else
+        upstream_files=""
+    fi
+
     # Compare file lists: the local fork should have the same files as
     # upstream at $upstream_hash, plus any Red Bear patch files.
     cd "$fork_dir"
@@ -198,6 +212,11 @@ for fork_dir in local/sources/*/; do
     fi
 
     rm -rf "/tmp/verify-$fork_name"
+
+    # Cache successful verify result so subsequent preflight runs don't
+    # re-clone upstream. Stored under .redbear-fork-verify/<fork>-<tag>.
+    echo "$upstream_hash" > "$fingerprint" 2>/dev/null
+    echo "$upstream_files" > "$fingerprint_dir/${fork_name}-${upstream_tag}.files" 2>/dev/null
 done
 
 if [ "$violations" -gt 0 ]; then