fix: incremental rootfs builds so stale archives are never deployed

The deploy failed with "grub-install: command not found" in the chroot —
the installed rootfs archive was built BEFORE the BOOT/grub injection, so
it had no bootloader at all. build-iso.sh / build-image.sh only rebuilt
the rootfs when the archive was missing, never when sources changed, so
development fixes were silently absent from deployed images.

- build-rootfs.sh: incremental staleness check — skips a rebuild only when
  no input (scripts/, btrfs/, overlays/, editions/<e>/, versions.mk,
  toolchain debs) is newer than the artifact; FORCE=1 rebuilds anyway.
- build-iso.sh / build-image.sh: always delegate freshness to
  build-rootfs.sh instead of gating on file existence.
- deploy-disk.sh: defensive check that grub-install exists in the deployed
  rootfs, with a clear "stale archive — rebuild" message instead of a bare
  "command not found".
- docs/building.md: incremental-build note (FORCE=1 / make clean).

scripts/deploy-disk.sh

@@ -138,6 +138,12 @@ mount --bind /sys "$MNT/root/sys"
 # add a swapfile later if you want one — btrfs swapfiles need nocow).
 "$ROOT/scripts/apply-fstab.sh" "$MNT/root" "$EDITION" "$ROOT_UUID" "$EFI_UUID"
 
+# defensive: the deployed rootfs must carry the bootloader. A stale archive
+# from before the BOOT/grub injection has no grub-install at all.
+if ! chroot "$MNT/root" /bin/bash -c 'command -v grub-install >/dev/null 2>&1'; then
+  die "grub-install not found in the deployed rootfs — the rootfs archive is stale; rebuild it (FORCE=1 make iso-$EDITION or make clean)"
+fi
+
 chroot "$MNT/root" /bin/bash -c '
 set -e
 case "$1" in