deb: add opt-in --incremental flag for single-flag iterate loops

Iterating on a package currently needs two flags (--resume --keep):
without --keep a successful build consumes the session, and without
--resume nothing is reused, so incremental iteration never "just
works" opt-in.

--incremental is the single-flag form: with no --resume it adopts the
newest usable session of this tree (like `pkh deb --resume`), and it
always keeps the session on success, so the loop (edit, `pkh deb
--incremental`, edit, ...) reuses the chroot, build deps and objects
and only recompiles what changed. With an explicit `--resume <id>` it
only adds keep.

A plain `pkh deb` is unchanged: fresh session, consumed on success.

README.md

@@ -133,6 +133,9 @@ pkh deb --resume        # reuses the chroot, build deps and objects;
                         # only what changed is recompiled
 pkh deb list            # the sessions of this tree, with their ids
 pkh deb --resume <id>   # resume a specific session
+pkh deb --incremental   # one-flag iterate loop: adopts the newest
+                        # session like `--resume` and keeps it on
+                        # success (with `--resume <id>`, only adds keep)
 pkh deb --keep          # keep the session even after a successful build
                         # (iterate: edit, `pkh deb --resume --keep`, ...)
 pkh prune               # garbage-collect old sessions (7-day retention)
@@ -142,6 +145,12 @@ A plain `pkh deb` never reuses a session — everything is rechecked from
 scratch — and it replaces the session of its target. `pkh deb --resume`
 refuses to adopt a session built for a different series/architecture.
 
+`pkh deb --incremental` combines `--resume` (without an ID) with
+`--keep`, so iterating is a single flag: each successful build keeps the
+session and the next `--incremental` build reuses it, recompiling only
+what changed. With an explicit `--resume <id>` it only adds keep. A plain
+`pkh deb` still never reuses a session and consumes it on success.
+
 Packages whose `debian/rules` keeps an input-untracked stamp cache (the
 kernels' `debian/stamps`) declare it in the quirks data (`resume_clear`):
 resumed builds drop the cache so the wrapper steps — including the