Drop blob branch and rebuild prebuilt on PRs

[jserv]

Switch the kernel/rootfs prebuilt artifacts from the orphan blob branch to the fixed-tag prebuilt GitHub prerelease, and close the long-standing gap where a PR that touched configs/scripts/target would silently run make check against the stale prebuilt instead of its own change.

---

Summary by cubic

Switch prebuilts to a fixed-tag GitHub prerelease and add PR drift detection that rebuilds kernel/rootfs when configs/scripts/target change. This stops CI from testing against stale artifacts and keeps large binaries out of the repo.

• New Features

  • Detect input drift on PRs and rebuild Image and rootfs.cpio from source; artifacts are passed to all test jobs (including macOS).
  • Use released/cached prebuilts only when no drift; cache keyed by mk/external.mk and all inputs.

• Refactors

  • Replace blob branch with the prebuilt prerelease; update URLs and SHA1s in mk/external.mk.
  • Make downloads atomic and verified (.part/.tmp, strict SHA1, no resume) to avoid corrupt artifacts.
  • prebuilt.yml auto-publishes on master when inputs change, and still supports workflow_dispatch.

^{Written for commit 43fe61b. Summary will update on new commits. Review in cubic}

[cubic-dev-ai]

No issues found across 3 files