fix(hardlink): content freshness moved switches, it was not withdrawn

`unshare_mutable_paths`' comment recorded that upstream had stopped
rewriting `dep-<target>` in place, on a measurement taken against
1.100.0-nightly. It had not. Two unrelated cargo changes landed within
four days of each other and between them moved the switch that turns the
behaviour on and the path it writes to:

  - cargo PR #17382 (2026-08-22) demoted `-Z checksum-freshness` to a
    gate and gave `build.fingerprint` the choice, defaulting to `mtime`.
    Setting only the gate is accepted and does nothing, which is exactly
    the result that was read as a withdrawal.
  - build-dir layout v2 (cargo PR #17354, stable 1.100.0 on 2026-11-12,
    nightly default since 1.99) moved the file from
    `.fingerprint/<unit>/dep-*` to `build/<pkg>/<hash>/fingerprint/dep-*`.

Measured 2026-08-26 on 1.100.0-nightly (e8cb624d5): same toolchain, same
clone procedure, one env var apart — with the gate alone a `cp -al` clone
mutates only the build/ and *.d families; add
`CARGO_BUILD_FINGERPRINT=content` and the source's dep-info file is
mutated through the shared inode again. The hazard is intact.

So the suite now exports both switches, and its strongest scenario runs
again on current nightlies — verified passing against both layouts. Its
control note learned the v2 path too: it looked for the v1 path only, and
so printed "does NOT rewrite ... in place" three lines beneath a listing
that showed the rewrite.

Every claim these comments make is now dated and cited, because the
defect being fixed is a comment that cited one measurement and silently
stopped reproducing.

Layout v2 also drags the artifacts under `build/`, which collapses this
function's real-copy set from 21.3% of a target dir to 99.998%. That is a
live cost, not a correctness problem, and it is filed as gitdan-actions#14
rather than fixed here.

Part of daniel/gitdan#62.

README.md

@@ -31,14 +31,23 @@ One thing neither project had, and the reason the clone is not a plain
 `cp -al`: **a build inside a hardlink clone does mutate the directory it was
 cloned from.** Cargo writes real artifacts by replacing them, but writes its
 metadata — and build scripts write their `OUT_DIR` — with a plain truncating
-write, straight through the shared inode. Under
-`CARGO_UNSTABLE_CHECKSUM_FRESHNESS` the file that gets corrupted is
-`.fingerprint/<unit>/dep-<target>`, which holds the per-source checksums that
-decide freshness, and the failure is silent stale-artifact reuse rather than a
-slow build. `scripts/hardlink-clone-selftest.sh` reproduces it as an explicit
-control and asserts the fix. The fix is to hardlink the artifacts (the GB) and
-real-copy the metadata (the MB) — about 3.7% of a Bevy-sized target directory,
-against 100% for a full copy.
+write, straight through the shared inode. When Cargo resolves freshness by
+content the file that gets corrupted is its dep-info fingerprint —
+`.fingerprint/<unit>/dep-<target>`, or
+`build/<pkg>/<hash>/fingerprint/dep-<target>` under Cargo's build-dir layout v2
+— which holds the per-source checksums that decide freshness, and the failure
+is silent stale-artifact reuse rather than a slow build.
+`scripts/hardlink-clone-selftest.sh` reproduces it as an explicit control and
+asserts the fix. The fix is to hardlink the artifacts (the GB) and real-copy
+the metadata (the MB) — about 3.7% of a Bevy-sized target directory, against
+100% for a full copy.
+
+That ratio is a **layout-v1** figure and does not survive layout v2, which
+regroups artifacts under `build/` alongside the metadata and so drags nearly
+the whole tree into the real-copy set. Measured 2026-08-26 at 99.998% on a
+scratch crate. v2 is the nightly default and stabilises in cargo 1.100.0 on
+2026-11-12; the correctness guarantee above is unaffected, the saving is not.
+Tracked as [#14](https://gitdan.com/daniel/gitdan-actions/issues/14).
 
 ---
 
@@ -98,10 +107,14 @@ env:
   CARGO_INCREMENTAL: 0                  # per-run bloat on a persistent volume
   CARGO_PROFILE_DEV_DEBUG: line-tables-only
   CARGO_PROFILE_TEST_DEBUG: line-tables-only
-  # Nightly only. Content-addressed freshness instead of mtime-based — a
-  # strictly stronger guarantee, complementary to the mtime restore (which
-  # still covers directory-form `rerun-if-changed` build-script watches).
+  # Nightly only, and BOTH are needed. Content-addressed freshness instead of
+  # mtime-based — a strictly stronger guarantee, complementary to the mtime
+  # restore (which still covers directory-form `rerun-if-changed` build-script
+  # watches). Since cargo PR #17382 (2026-08-22) the `-Z` gate below only
+  # unlocks the feature; `build.fingerprint` selects it and defaults to
+  # `mtime`, so the gate on its own is accepted and does nothing.
   CARGO_UNSTABLE_CHECKSUM_FRESHNESS: "true"
+  CARGO_BUILD_FINGERPRINT: "content"
 ```
 
 ---
@@ -562,7 +575,7 @@ change here reaches all of them at once. That is what the gate is for.
 | suite | covers |
 |---|---|
 | `cache-root-selftest.sh` | that a lineage nests one level and nothing else moves: no lineage resolves byte-for-byte to the cache root, two lineages on one cache key get disjoint target dirs, seed/publish/prune all stay inside their own lineage, a PR layers over its own lineage's base snapshot — **and one rejection per lineage name a reader elsewhere would stop seeing**, plus the publish-side mismatch guard |
-| `hardlink-clone-selftest.sh` | that a build in a clone cannot mutate its source — with a control proving a raw `cp -al` does. Needs a real compiler, **and a nightly that actually resolves freshness by content for its last scenario**: the source's-next-build check reasons about content rather than mtime, so under mtime freshness it would assert a bug. Whether the toolchain does is settled by experiment on a throwaway crate, not by asking it — 1.100.0-nightly accepts `-Z checksum-freshness` and rebuilds on mtime anyway. The experiment reports **three** outcomes, not two: active, measured-inactive, and *not measured*. Its answer codes are `0` and `3`, deliberately clear of every status bash generates for its own errors — so nothing that goes wrong inside the probe, including an expansion failure no guard can catch, can be read as an answer. The scenario is skipped for the last two alike, but a failure to measure is never reported as a measurement. The control also reports which mutation families the running Cargo exhibits — a note, not an assertion, since that set moves upstream. |
+| `hardlink-clone-selftest.sh` | that a build in a clone cannot mutate its source — with a control proving a raw `cp -al` does. Needs a real compiler, **and a nightly that actually resolves freshness by content for its last scenario**: the source's-next-build check reasons about content rather than mtime, so under mtime freshness it would assert a bug. Whether the toolchain does is settled by experiment on a throwaway crate, not by asking it — accepting `-Z checksum-freshness` stopped implying it on 2026-08-22, when cargo PR #17382 demoted the flag to a gate and gave `build.fingerprint` (default `mtime`) the choice; the suite now exports both and 1.100.0-nightly measures ACTIVE again. The experiment reports **three** outcomes, not two: active, measured-inactive, and *not measured*. Its answer codes are `0` and `3`, deliberately clear of every status bash generates for its own errors — so nothing that goes wrong inside the probe, including an expansion failure no guard can catch, can be read as an answer. The scenario is skipped for the last two alike, but a failure to measure is never reported as a measurement. The control also reports which mutation families the running Cargo exhibits — a note, not an assertion, since that set moves upstream. |
 | `seed-target-dir-selftest.sh` | seed-source preference, lock-file stripping, two jobs racing on one cache key, **and one scenario per check a hardlink clone is validated against**: a source rotated wholesale, a subtree silently lost from the walk, a copy that reports failure over a tree both other checks read as whole, and a source identity that resolved at neither end — plus a staging tree that could not be privately owned being discarded rather than published, and the publisher's log showing it waited on the consumer's own reader-lock marker before reclaiming a rotated snapshot |
 | `publish-snapshot-selftest.sh` | the atomic swap, that a live consumer survives a republish, and the publisher's side of the rotation race: deferred reclamation under a live reader, and its sweep once the reader is gone |
 | `prune-cache-selftest.sh` | liveness, protection, locking, eviction order, self-clear, **and that a cache a job claims *inside* the check-to-unlink window survives it** — against a real scratch `origin` |