build: only redistribute the orig tarball on new upstream (-si)

dpkg-genchanges includes the upstream tarballs in the .changes only when
the upload brings a new upstream: no previous changelog entry, a changed
upstream version or a renamed source. On a plain revision bump the
tarball already sits in the archive, and dpkg strips it (and its .asc)
from the distribution set.

pkh's native source pipeline listed every .dsc-referenced tarball
unconditionally, making every upload re-ship the orig. Implement the
dpkg source styles as --orig auto|always|never (auto being the -si
default; always/never are -sa/-sd), stripping the tarballs out of the
changes, buildinfo-free checksum set and artifact list like dpkg, with
the explicit 'never' ignored for native packages. Comparison uses the
epoch-less upstream version, exactly like dpkg's version().

Differential tests against real dpkg cover revision bumps, new upstream
versions and both forced styles.

src/new/questions.rs

@@ -598,7 +598,11 @@ pub async fn offer_verification(
     }
 
     let ui = Some(std::sync::Arc::new(crate::ui::deb::DebUi::new(multi)));
-    if let Err(e) = crate::build::build_source_package(Some(&tree), ui) {
+    if let Err(e) = crate::build::build_source_package(
+        Some(&tree),
+        crate::build::SourceBuildOptions::default(),
+        ui,
+    ) {
         log::error!("Verification source build failed: {e}");
         log::info!(
             "The scaffolded tree is intact. Inspect it, then retry with \