deb: survive crashed sessions and config-blind resumes

Two failures from resumed kernel sessions:

A resumed build re-runs debian/rules build, but the kernels keep
their wrapper-step stamps in debian/stamps and the flavour config
rule there exports .config from the annotations with no config
prerequisite: the resumed build silently kept the previous
attempt's configuration and a config edit never reached the .deb.
Dropping the stamp cache unconditionally would impose the kernel
packaging's shape on every package, so it is data-driven instead:
packages declare the caches under a resume_clear quirk, and
resumed builds remove those tree-relative paths before the build.
The inner kbuild keeps its own incremental state, so only the
cheap wrapper passes re-run and config-affected objects recompile.

A SIGKILLed build (OOM) leaves its overlay mounts and /proc bind
mount behind, and overlayfs creates root-owned work state inside
the workdir: the next plain build (recording is always on, it
replaces the session of its identity) failed to clear the
leftovers with a permission error. Session clearing now unmounts
everything under each entry at depth (re-reading /proc/mounts,
tolerating mount stacks from consecutive crashes) and escalates
through sudo; when the tree still cannot be cleared, the build
reports it and continues without a session instead of layering
over a half-cleared one.

data/quirks.yml

@@ -23,8 +23,20 @@ quirks:
   # architecture only, so a cross build installs no build-architecture
   # variants and the kernel's host-side tools cannot link.  Inject the
   # build-architecture variants until the control is fixed upstream.
+  # The kernel's debian/rules keeps its wrapper-step stamps in
+  # debian/stamps, and the flavour config rule there exports .config from
+  # the annotations with no config prerequisite — a resumed build would
+  # keep the previous attempt's configuration and silently ignore config
+  # edits. List the stamp cache under `resume_clear` so resumed builds
+  # drop it and re-run the wrapper steps; the inner kbuild keeps its own
+  # incremental state, so only the cheap wrapper passes re-run. This is
+  # the packaging's long-standing shape rather than a fixable regression,
+  # so the entry applies to every series.
   linux:
     deb:
+      - series: []
+        resume_clear:
+          - debian/stamps
       - series: [resolute]
         dependencies:
           replace:
@@ -37,6 +49,9 @@ quirks:
             - libssl-dev:native
   linux-riscv:
     deb:
+      - series: []
+        resume_clear:
+          - debian/stamps
       - series: [resolute]
         dependencies:
           replace: