fix: incremental rootfs builds so stale archives are never deployed

The deploy failed with "grub-install: command not found" in the chroot —
the installed rootfs archive was built BEFORE the BOOT/grub injection, so
it had no bootloader at all. build-iso.sh / build-image.sh only rebuilt
the rootfs when the archive was missing, never when sources changed, so
development fixes were silently absent from deployed images.

- build-rootfs.sh: incremental staleness check — skips a rebuild only when
  no input (scripts/, btrfs/, overlays/, editions/<e>/, versions.mk,
  toolchain debs) is newer than the artifact; FORCE=1 rebuilds anyway.
- build-iso.sh / build-image.sh: always delegate freshness to
  build-rootfs.sh instead of gating on file existence.
- deploy-disk.sh: defensive check that grub-install exists in the deployed
  rootfs, with a clear "stale archive — rebuild" message instead of a bare
  "command not found".
- docs/building.md: incremental-build note (FORCE=1 / make clean).

docs/building.md

@@ -47,6 +47,13 @@ Everything lands under `build/`:
 
 Each artifact ships with a `.sha256` checksum file.
 
+> **Incremental builds:** `build-rootfs.sh` is incremental — it skips a rebuild
+> when no input (scripts, editions, overlays, versions.mk, toolchain debs) has
+> changed since the last archive, so `make iso-<edition>` only redoes
+> debootstrap when something actually changed. This also means a stale archive
+> can never be deployed: any source change forces a fresh rootfs. Rebuild
+> unconditionally with `FORCE=1 make rootfs-<edition>` (or `make clean`).
+
 ## Disk images & installing
 
 - `make image-<edition>` builds a bootable **qcow2** disk image (the cloud