Timestamp comparisons can reuse an archive produced by another worktree, causing Depends to build stale local sources.
Specifically, depends caches packages using `$(package)_local_dir` as a tarball in `SOURCES_PATH`. The tarball is currently recreated only when `find -newer` reports a path newer than the cached archive.
This does not reliably identify directory contents:
- Two worktrees sharing `SOURCES_PATH` can contain different source trees.
- A tarball created by one worktree may be newer than every path in another.
- Deleting a file leaves no path whose mtime can be checked.
- Changed or restored files may have older or equal mtimes.
- Timestamp granularity and clock differences make ordering unreliable.
`native_libmultiprocess` is currently the only package using `local_dir`.
Local source identity should change when any of the following changes:
- A file is added, removed, or modified.
- File permissions, including the executable bit, change.
- A symlink target changes.
- An empty directory is added or removed.
Filesystem timestamps, ownership paths, and absolute worktree locations should not determine the identity. Identical trees in separate worktrees should produce the same archive checksum.
Different trees using the same shared `SOURCES_PATH` must be able to coexist.
---
Generate normalized archives with CMake and key them by SHA256 so distinct trees can coexist safely in a shared source cache.
Keep the archive hash as the recipe input so existing package and dependent build ID propagation remains unchanged.
