test: regression suite for vendored-source staleness invalidation + wire into CI

Proves build-redbear.sh's vendored source/ staleness loop: seeds on first sight
(no spurious rebuild), stays quiet unchanged, and invalidates target/ on
committed/uncommitted/untracked source/ changes. Keeps the loop body in sync.

.github/workflows/redbear-ci.yml

@@ -35,6 +35,9 @@ jobs:
       - name: Versioning machinery unit tests
         run: ./local/scripts/test-versioning-machinery.sh
 
+      - name: Vendored-source staleness invalidation test
+        run: ./local/scripts/test-vendored-source-staleness.sh
+
       - name: External recipe source-version consistency
         # Fails if any tar recipe's vendored source/ (or tracked source.tar)
         # diverges from its declared version — the Qt/KDE class of bug. Mirrors