fix: incremental rootfs builds so stale archives are never deployed

The deploy failed with "grub-install: command not found" in the chroot —
the installed rootfs archive was built BEFORE the BOOT/grub injection, so
it had no bootloader at all. build-iso.sh / build-image.sh only rebuilt
the rootfs when the archive was missing, never when sources changed, so
development fixes were silently absent from deployed images.

- build-rootfs.sh: incremental staleness check — skips a rebuild only when
  no input (scripts/, btrfs/, overlays/, editions/<e>/, versions.mk,
  toolchain debs) is newer than the artifact; FORCE=1 rebuilds anyway.
- build-iso.sh / build-image.sh: always delegate freshness to
  build-rootfs.sh instead of gating on file existence.
- deploy-disk.sh: defensive check that grub-install exists in the deployed
  rootfs, with a clear "stale archive — rebuild" message instead of a bare
  "command not found".
- docs/building.md: incremental-build note (FORCE=1 / make clean).

scripts/build-iso.sh

@@ -30,14 +30,9 @@ ARTIFACT="$ARTIFACT_DIR/arcline-$EDITION-$VERSION-$ARCH.iso"
 # ── 1. rootfs(es) ───────────────────────────────────────────────────────────
 # The ISO is a live session (built on top of the clean rootfs) and carries the
 # CLEAN rootfs archive as the install source for the graphical installer.
-if [[ ! -d "$CLEAN" ]]; then
-  log "clean rootfs missing — building it first"
-  "$ROOT/scripts/build-rootfs.sh" "$EDITION"
-fi
-if [[ ! -f "$INSTALL_ARC" ]]; then
-  log "clean rootfs archive missing — building it first"
-  "$ROOT/scripts/build-rootfs.sh" "$EDITION"
-fi
+# build-rootfs is incremental (skips when inputs are unchanged) and rebuilds
+# when any input is newer — so a stale archive can never be deployed again.
+"$ROOT/scripts/build-rootfs.sh" "$EDITION"
 "$ROOT/scripts/build-live.sh" "$EDITION"
 
 # ── 2. stage files ──────────────────────────────────────────────────────────