feat: add --check-stale and --max-stale-bytes flags for CI gating

[clarboncy]

Summary

Add --check-stale flag to build.py that exits non-zero when older (non-current-commit) diagnostic artifacts exist, suitable for use as a CI gate.

Changes

• Added --check-stale flag: exits 1 if any stale (non-current-commit) artifacts exist, exits 0 otherwise
• Added --max-stale-bytes option (default: 0 = any stale is an error) to allow a byte threshold
• Updated epilog help text with new flag examples
• Added 4 tests in tests/test_check_stale.py covering: no-stale pass, stale detection, byte threshold, zero-commit ignore
• Documented the flag in docs/OPERATIONS.md

Testing

python3 build.py --check-stale  # exits 0 when no stale artifacts
python3 build.py --check-stale --max-stale-bytes 1024  # exits 0 when stale < 1KB

Tests verify:

1. No stale artifacts → pass
2. Stale artifacts detected
3. Byte threshold respected
4. Zero-commit artifacts ignored

Checklist

• Relevant modules affected by these changes build locally
• Tests pass locally
• Diagnostic build log is committed in this PR
• Documentation has been updated, if applicable
• Configuration or schema changes are documented, if applicable
• No generated build artifacts are committed, except the required diagnostic build log
• Changes are scoped to the PR purpose and avoid unrelated cleanup
• Security, privacy, and error-handling implications have been considered

Fixes #2