test: rebuild a stale repo pkh binary before the e2e run

resolve_pkh preferred target/release/pkh however old it was: after a
commit without a release rebuild, the harness measured the previous
code — the 54-package run recorded before this change exercised the
pre-nested-namespace builds and recorded no phase profiles, the
profile feature itself being newer than that binary. A repo binary is
now rebuilt when it is older than HEAD or than the newest source edit;
an explicit --pkh still pins whatever binary it names.

tests/e2e/run.py

@@ -908,14 +908,52 @@ def main(argv: list[str]) -> int:
         return 130
 
 
+def repo_source_epoch() -> float | None:
+    """The newest evidence of source changes: HEAD's commit time, or the
+    newest mtime under src/ for uncommitted edits. None outside a git
+    checkout with no src/ tree."""
+    stamps = []
+    try:
+        out = subprocess.run(
+            ["git", "log", "-1", "--format=%ct"],
+            cwd=REPO_ROOT, capture_output=True, text=True, check=True,
+        )
+        stamps.append(int(out.stdout.strip()))
+    except Exception:
+        pass
+    src = REPO_ROOT / "src"
+    if src.is_dir():
+        stamps.extend(path.stat().st_mtime for path in src.rglob("*.rs"))
+    return max(stamps) if stamps else None
+
+
 def resolve_pkh(args: argparse.Namespace) -> Path:
     if args.pkh:
         path = Path(args.pkh).resolve()
         if not path.is_file():
             raise CatalogError(f"--pkh: no such file: {path}")
         return path
-    if args.build_pkh:
+
-        subprocess.run(["cargo", "build", "--release"], cwd=REPO_ROOT, check=True)
+    # A repo binary older than the sources measures whatever the last
+    # `cargo build --release` happened to include — yesterday's code.
+    # Rebuild unless the caller pinned a binary or asked for it explicitly.
+    if not args.build_pkh:
+        head = repo_source_epoch()
+        fresh = head is not None and any(
+            candidate.is_file() and candidate.stat().st_mtime >= head
+            for candidate in (REPO_ROOT / "target/release/pkh",
+                              REPO_ROOT / "target/debug/pkh")
+        )
+        if fresh:
+            return next(candidate
+                        for candidate in (REPO_ROOT / "target/release/pkh",
+                                          REPO_ROOT / "target/debug/pkh")
+                        if candidate.is_file()
+                        and candidate.stat().st_mtime >= head)
+        print("[pkh-e2e] the repo pkh binary is older than the sources; "
+              "running 'cargo build --release'")
+
+    subprocess.run(["cargo", "build", "--release"], cwd=REPO_ROOT, check=True)
     for candidate in (REPO_ROOT / "target/release/pkh", REPO_ROOT / "target/debug/pkh"):
         if candidate.is_file():
             return candidate