CI: make the build safer

The CI builds used to cache the build directory when the build job was
invoked indirectly, via a change to another repo. That was not working
well; there were situations where a change made via
`submodules/dependencies` was not picked up properly. Also, the caching
itself took about 10 minutes, which kinda defeats the point of caching
in the first place.

Fix this by always performing a full rebuild from scratch, with no
previous state whatsoever.

Also, add some safeguards:

- show exactly what gets picked at the level of Buildroot (yay Makefile
  and shell magic)
- reject any changes brought in transitively *iff* we're changing
  br2-external and if that change doesn't sync the submodule which was
  pulled in

Change-Id: Ief4ac98218c7f6801fd303cf0015789535edcaf5
diff --git a/.zuul.yaml b/.zuul.yaml
index cb977cb..da25c73 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -30,15 +30,7 @@
 - project:
     check:
       jobs:
-        - czechlight-clearfog:
-            provides: CzechLight-br2-build-clearfog
-            vars:
-              artifacts:
-                name: br2-work-dir
-                glob: 'br2-work-dir-*.tar.zst'
-            post-run: ci/post.yaml
-            roles:
-              - zuul: return-built-artifact
+        - czechlight-clearfog
 
     promote:
       jobs: