[FIX] stage 2: do not restore what it no longer trusts

Removing a name from stage2.state means its stage-2 artefact is not trusted --
that is the whole meaning of removing it. The restore ignored that and put the
package back anyway, undoing the fix that motivated the removal before the
rebuild could run.

It happened twice. binutils had to be moved out of repo2 by hand. filesystem
was worse because it was invisible: its pass-one build predates the hook adding
s390x's lib64 symlinks, so restoring it REMOVED the symlink stage 1 had just
installed. /usr/lib64 was absent again and the fix looked like it had failed.

pkgbase, not pkgname: stage2.state records what was built, and libxml2-docs is
not in it under that name.

The diagnosis also took a wrong turn worth recording. `test -L` failing was
reported as "a real directory", but it fails just as readily on a path that does
not exist -- which was the actual state. The check now says what the path IS.

--- FR ---

Retirer un nom de stage2.state signifie que son artefact d'étage 2 n'est plus de
confiance — c'est tout le sens du retrait. La restauration l'ignorait et le
réinstallait quand même, défaisant le correctif qui avait motivé le retrait avant
que la reconstruction puisse tourner.

Deux fois. binutils a dû être écarté de repo2 à la main. filesystem était pire
car invisible : sa construction de la passe 1 précède le hook ajoutant les liens
lib64 de s390x, donc le restaurer SUPPRIMAIT le lien que l'étage 1 venait de
poser. /usr/lib64 disparaissait et le correctif semblait inopérant.

pkgbase, pas pkgname : stage2.state enregistre ce qui a été bâti, et
libxml2-docs n'y figure pas sous ce nom.

Le diagnostic a aussi pris un mauvais chemin qui mérite d'être noté. L'échec de
`test -L` était rapporté comme « vrai répertoire », alors qu'il échoue tout
autant sur un chemin absent — l'état réel. Le test dit maintenant ce que le
chemin EST.

Assisted-by: Claude Opus 5

scripts/build-stage2.sh

@@ -187,12 +187,33 @@ EOF
     local back=() inst f pn
     if [ "${#cand[@]}" -gt 0 ]; then
         inst=$(sudo pacman --root "$ROOT" --config "$CONF" -Qq 2>/dev/null)
+        local pb
         for f in "${cand[@]}"; do
             pn=$(bsdtar -xOf "$f" .PKGINFO 2>/dev/null | sed -n 's/^pkgname = //p')
             [ -n "$pn" ] || continue
-            grep -qxF "$pn" <<< "$inst" && back+=("$f")
+            grep -qxF "$pn" <<< "$inst" || continue
+            # AND it must still be one stage 2 considers done.
+            #
+            # A name removed from stage2.state is exactly a package whose
+            # stage-2 artefact is no longer trusted -- that is what removing it
+            # MEANS. Restoring it anyway undoes the fix that motivated the
+            # removal, before the rebuild gets a chance to run.
+            #
+            # It happened twice, and the second time was invisible. The
+            # filesystem package built in pass one predates the hook that adds
+            # s390x's lib64 symlinks; restoring it REMOVED the symlink that
+            # stage 1 had just installed, so /usr/lib64 was absent again and
+            # the fix appeared not to work. binutils was the same shape and had
+            # to be moved out of repo2 by hand -- which is a workaround for a
+            # rule that was simply missing.
+            #
+            # pkgbase, not pkgname: stage2.state records what was BUILT, and a
+            # split package like libxml2-docs is not in it under that name.
+            pb=$(bsdtar -xOf "$f" .PKGINFO 2>/dev/null | sed -n 's/^pkgbase = //p')
+            grep -qxF "${pb:-$pn}" "$STATE2" 2>/dev/null || continue
+            back+=("$f")
         done
-        printf '  %s of %s stage-2 package(s) are installed here\n' \
+        printf '  %s of %s stage-2 package(s) are installed and still trusted\n' \
             "${#back[@]}" "${#cand[@]}"
     fi
     if [ "${#back[@]}" -gt 0 ]; then