Reject stale native runtime build provenance before release staging

docs/BUILDING.md

@@ -162,6 +162,11 @@ full extracted archive smoke. A legacy worker lacking `--role query` can build
 document vectors while failing foreground search. The archive smoke retains
 captured CLI error output when a command exits unsuccessfully.
 
+Normal runtime inventories now include build-input provenance. Rebuild the
+normal runtime before staging historical caches; source changes invalidate
+their inventory even if the stored file checksums are valid. See
+[runtime provenance](RUNTIME-PROVENANCE.md) for scope and actual validation.
+
 The optional Linux missing-loader check requires explicit root execution and
 util-linux mount namespaces/chroot. It never escalates privileges and verifies
 a private namespace before creating an isolated filesystem: