build: pre-cook honors --upstream; revert wrong source.tar gitignore

Two corrections after finding the Qt offline-source model:

1. The Qt recipes intentionally COMMIT source.tar as the offline source
   (qtbase/qtsvg/qtshadertools all do). My previous commit wrongly added a
   local/recipes/**/source.tar ignore rule; revert it -- source.tar is durable
   here, only source/ is the fork model.

2. Real deficiency: the pre-cook offline decision honored only the
   REDBEAR_ALLOW_UPSTREAM env var, while the main `make live` phase also goes
   online for the --upstream flag (ALLOW_UPSTREAM=1). So `--upstream` alone left
   the pre-cook OFFLINE but the main phase ONLINE -- a package missing its
   source.tar cache (e.g. right after the stale 6.11.0 tars were purged) failed
   the pre-cook with "Opening file for blake3 failed ... source.tar: No such
   file". Make the pre-cook honor ALLOW_UPSTREAM too, matching the main phase.

.gitignore

@@ -26,14 +26,6 @@ recipes/**/source-old
 recipes/**/source.tar
 recipes/**/source.tar.tmp
 recipes/**/source.pre-preservation-test/
-# A `source.tar` is ALWAYS the downloaded tarball fetch-cache (verified against
-# recipe.toml's blake3), never durable code — unlike `source/` (the fork model).
-# The `recipes/**` rules above only match the mainline recipes/ tree, so
-# local/recipes/ tarball caches slipped through and got committed. They then went
-# stale on version bumps (Qt 6.11.0 tars shadowing 6.11.1 URLs -> blake3
-# mismatch, build failure). Ignoring the tarball (not source/) is safe.
-local/recipes/**/source.tar
-local/recipes/**/source.tar.tmp
 local/recipes/archives/uutils-tar/source
 local/recipes/dev/ninja-build/source
 

local/scripts/build-redbear.sh

@@ -928,16 +928,20 @@ for pkg in $PRECOOK_PKGS; do
     if [ ! -f "$PROJECT_ROOT/repo/x86_64-unknown-redox/$pkg.pkgar" ]; then
         echo "    cooking $pkg..."
         log=$(mktemp)
-        # Pre-cook offline/upstream policy must match the main build phase:
-        # the previous hardcoded COOKBOOK_OFFLINE=false meant pre-cook could
-        # fetch packages the main phase refused to use, leaving the repo in
-        # an inconsistent state when ALLOW_UPSTREAM was not set.
-        case "${REDBEAR_ALLOW_UPSTREAM:-0}" in
-            1)
-                PRECOOK_OFFLINE=false ;;
-            *)
-                PRECOOK_OFFLINE=true ;;
-        esac
+        # Pre-cook offline/upstream policy must match the main build phase
+        # (see the `make live` dispatch below). The main phase goes online when
+        # EITHER the REDBEAR_ALLOW_UPSTREAM env var is 1 OR the --upstream flag
+        # (ALLOW_UPSTREAM=1) is passed; it goes offline in release mode. The
+        # pre-cook previously honored only REDBEAR_ALLOW_UPSTREAM, so a plain
+        # `--upstream` invocation left the pre-cook OFFLINE while the main phase
+        # was ONLINE — any package missing its source.tar cache (e.g. after a
+        # version bump) then failed the pre-cook with "Opening file for blake3
+        # failed ... source.tar: No such file". Honor ALLOW_UPSTREAM here too.
+        if [ "${REDBEAR_ALLOW_UPSTREAM:-0}" = "1" ] || [ "${ALLOW_UPSTREAM:-0}" -eq 1 ]; then
+            PRECOOK_OFFLINE=false
+        else
+            PRECOOK_OFFLINE=true
+        fi
         if [ -n "${REDBEAR_RELEASE:-}" ]; then
             PRECOOK_OFFLINE=true
         fi