rebuild — clean-room DR rebuild tooling

Scripts that assemble the restore bundle (runtime state + code) so the Conductor / jazz-stack can be rebuilt in a fresh "hard VM". The bundle mounts restore off / as a copy (not a clone), so packages are checked out on disk.

- build_restore_source.py — one-shot: checkout → stage → link → verify. Rebuilds ~/rebuild/restore fresh each run. Use this. - test-checkout.py — check out the 6 stack packages (branch-correct — jazz-forge/shadow-forge on master; robust prune-fetch + unshallow; submodule-safe). - test-artifacts.py — stage runtime state (~/bin lean, ~/.jazz, ~/.secrets, ~/jail); --with-code also checks out the packages into the stage. - test-link.py — link the packages into one git as submodules + a flag-free-clone bootstrap.py (a plain git clone works without --recurse-submodules; bootstrap.py populates offline from the bundle's forge remotes, else gitlab). - test-verify.py — assert every package is fully checked out (exit 0 = ready to copy/mount).

Config via env (no hardcoded paths): REBUILD_STAGE (default ~/rebuild/restore), FORGE_REMOTES, GITLAB_NS. The heavy/regenerable state (VM images, pre-* junk, rolling backups, logs) is excluded; .secrets is staged 0700 + gitignored; the wallet seed is never staged. The rebuild procedure itself is shadow-forge/REBUILD_PROMPT.md.