fix(test): compare the baked build ID against the build-time git observation

[owjs3901]

The version_build_id_reports_the_repository_dirty_state gate compared the -dirty suffix baked into the binary at compile time against a git status the test ran at test time. Those are two observations of the working tree at two different moments, so an untracked file appearing in between - a probe script, a scratch log - made a correctly behaving binary report clean while the test's own git call reported dirty. The assertion failed with no bug to find. It failed exactly that way during the line-box investigation.

What changed

build.rs now publishes what it observed rather than letting it survive only as a suffix:

• DEVUP_MCP_GIT_DIRTY - true / false / unknown when git could not be asked
• DEVUP_MCP_BUILD_ID_SOURCE - git / env / unknown, so an injected DEVUP_MCP_BUILD_ID is not mistaken for a git observation

The test asserts against those build-time facts. An injected identity carries whatever suffix its caller chose, and an unknown observation says nothing about this plumbing, so neither is asserted. The run-time comparison stays as a note on stderr: a tree that moved between building and running is information about the run, not a fault in the binary.

What remains under test is the chain that can actually break - the git observation, the suffix git_identity derives from it, and --version printing the baked value faithfully.

Verification

The failing sequence, reproduced on a clean tree and now passing:

1. clean tree -> build -> devup-mcp 0.4.5 (aadffa5ab4ff), no suffix
2. add an untracked file -> tree dirty
3. re-run without recompiling (the build script does not re-run; rerun-if-changed does not cover a new root-level file) -> 19 passed; 0 failed

Under the previous assertion step 3 evaluated false == true and failed.

Gates: fmt 0, clippy --locked --workspace --all-targets --all-features -D warnings 0, cargo test --workspace 1049 passed / 0 failed / 2 ignored, insta --check no drift, stdio_smoke 2 passed.