Guard make distclean against local/ overlay source deletion

make distclean now documents that local/ is protected and will NOT be deleted. Add make distclean-nuclear as the only path that can touch local overlay sources (requires REDBEAR_ALLOW_LOCAL_UNFETCH=1). Add unfetch risk comments in mk/repo.mk for local overlay recipes.

Makefile

@@ -51,6 +51,10 @@ endif # NOT_ON_PODMAN
 	$(MAKE) fstools_clean
 endif # PODMAN_BUILD
 
+# distclean: removes build artifacts, toolchain, and upstream source trees.
+# local/ overlay source trees are PROTECTED — the repo binary refuses to
+# unfetch local overlay recipes unless REDBEAR_ALLOW_LOCAL_UNFETCH=1 is set.
+# This is the safe default for Red Bear OS. local/ is NEVER deleted.
 distclean:
 ifeq ($(PODMAN_BUILD),1)
 ifneq ("$(wildcard $(CONTAINER_TAG))","")
@@ -61,11 +65,29 @@ else
 endif # CONTAINER_TAG
 else
 ifneq ($(NOT_ON_PODMAN),1)
+	$(info ==> distclean: cleaning build artifacts and upstream source trees)
+	$(info ==> local/ overlay sources are PROTECTED and will NOT be deleted)
 	$(MAKE) fetch_clean
 endif # NOT_ON_PODMAN
 	$(MAKE) clean NOT_ON_PODMAN=1
 endif # PODMAN_BUILD
 
+# distclean-nuclear: DESTRUCTIVE — also deletes local/ overlay source trees.
+# This is the OLD distclean behavior that can destroy Red Bear work.
+# You must set REDBEAR_ALLOW_LOCAL_UNFETCH=1 for this to actually delete
+# local overlay sources. Without it, the repo binary still protects them.
+# Use ONLY when you are certain you want to discard local overlay source code.
+distclean-nuclear:
+ifeq ($(PODMAN_BUILD),1)
+	$(info distclean-nuclear is not supported in Podman mode; use native build)
+else
+	$(warning !! distclean-nuclear will attempt to DELETE ALL source trees including local/ overlays)
+	$(warning !! This can destroy Red Bear OS work that is not committed to git)
+	$(warning !! The repo binary still protects local overlays unless REDBEAR_ALLOW_LOCAL_UNFETCH=1)
+	$(MAKE) fetch_clean REDBEAR_ALLOW_LOCAL_UNFETCH=1
+	$(MAKE) clean NOT_ON_PODMAN=1
+endif # PODMAN_BUILD
+
 pull:
 	git pull
 	rm -f $(FSTOOLS_TAG)

mk/repo.mk

@@ -168,6 +168,14 @@ rebuild-push: $(FSTOOLS_TAG) FORCE
 	$(MAKE) repo
 	$(MAKE) push
 
+# WARNING: unfetch deletes the recipe source tree.
+# For local overlay recipes (symlinked into local/), this will delete
+# source code in local/recipes/ that may not be recoverable.
+# The repo binary now guards against this, but verify with --dry-run first.
+# WARNING: unfetch --all deletes ALL recipe source trees.
+# For local overlay recipes (symlinked into local/), this will delete
+# source code in local/recipes/ that may not be recoverable.
+# The repo binary now guards against this for local overlays.
 # Invoke unfetch for one or more targets separated by comma
 u.%: $(FSTOOLS_TAG) FORCE
 ifeq ($(PODMAN_BUILD),1)