deb: survive crashed sessions and config-blind resumes

Two failures from resumed kernel sessions:

A resumed build re-runs debian/rules build, but the kernels keep
their wrapper-step stamps in debian/stamps and the flavour config
rule there exports .config from the annotations with no config
prerequisite: the resumed build silently kept the previous
attempt's configuration and a config edit never reached the .deb.
Dropping the stamp cache unconditionally would impose the kernel
packaging's shape on every package, so it is data-driven instead:
packages declare the caches under a resume_clear quirk, and
resumed builds remove those tree-relative paths before the build.
The inner kbuild keeps its own incremental state, so only the
cheap wrapper passes re-run and config-affected objects recompile.

A SIGKILLed build (OOM) leaves its overlay mounts and /proc bind
mount behind, and overlayfs creates root-owned work state inside
the workdir: the next plain build (recording is always on, it
replaces the session of its identity) failed to clear the
leftovers with a permission error. Session clearing now unmounts
everything under each entry at depth (re-reading /proc/mounts,
tolerating mount stacks from consecutive crashes) and escalates
through sudo; when the tree still cannot be cleared, the build
reports it and continues without a session instead of layering
over a half-cleared one.

plans/deb-incremental-builds.md

@@ -427,3 +427,29 @@ ephemeral}.rs`, `src/context/{api,unshare}.rs`, `src/prune.rs` and
   build → same; overlay mount unsupported/failed on resume → fresh
   copy staging (environment resume only, artifacts discarded); no
   host-tree snapshot → upper wiped and re-snapshotted.
+
+# Addendum: resume correctness (post-merge findings)
+
+Two real-world failures against a kept kernel session, both fixed:
+
+- **The kernel's config chain is stamp-blind** — `stamp-prepare-%`
+  (`debian/rules.d/2-binary-arch.mk`) exports `.config` from the
+  annotations with no config prerequisite, so a resumed build silently
+  kept the previous attempt's configuration; the config edit never
+  reached the .deb even though `debian/rules build` ran. Dropping the
+  stamp cache unconditionally would be a package-specific decision, so
+  it is data-driven: the kernels declare `resume_clear: [debian/stamps]`
+  in `data/quirks.yml`, and resumed builds remove those tree-relative
+  paths before `debian/rules build`. The inner kbuild keeps its own
+  state, so the re-run wrappers stay cheap and only config-affected
+  objects recompile.
+- **A SIGKILLed build (OOM) poisons the next one.** The crashed attempt
+  leaves its overlay mounts and /proc bind mount behind, and overlayfs
+  creates root-owned `work` state inside the workdir; the next PLAIN
+  build (recording is always on: it replaces the session of its
+  identity) failed to clear the leftovers with a permission error.
+  `clear_dir()` now unmounts everything under each entry at depth
+  (re-reading /proc/mounts, tolerating mount stacks from consecutive
+  crashes) and escalates through sudo; if the tree still cannot be
+  cleared, the plain build reports it and continues WITHOUT a session
+  instead of failing or layering over a half-cleared tree.