deploy.sh: rebuild local images when their Containerfile hash changes

buildah can serve a stale COPY --from layer (cache keyed on stage
name), so a Containerfile edit silently produced an unchanged image.
The image now carries a cfhash label; a mismatch forces a --no-cache
rebuild.

scripts/deploy.sh

@@ -144,9 +144,14 @@ if [ '${COMPOSE_UP[$TARGET]}' = '1' ]; then
   for dir in caddy loki alloy; do
     img=franksdank/\$dir
     [ \"\$dir\" = caddy ] && img=franksdank/caddy-porkbun
-    if ! podman image exists \$img:latest; then
-      echo \"  \$img image missing; building it...\"
-      podman build -t \$img:latest -f dankclaw/\$dir/Containerfile .
+    # Rebuild when the Containerfile changed. buildah's layer cache can
+    # serve a stale COPY --from layer (keyed on stage name), so a rebuild
+    # always runs with --no-cache.
+    cfhash=\$(sha256sum dankclaw/\$dir/Containerfile | cut -d' ' -f1)
+    oldhash=\$(podman image inspect \$img:latest --format '{{index .Config.Labels "cfhash"}}' 2>/dev/null || echo none)
+    if [ \"\$oldhash\" != \"\$cfhash\" ]; then
+      echo \"  \$img image missing or stale; building it...\"
+      podman build --no-cache --label cfhash=\$cfhash -t \$img:latest -f dankclaw/\$dir/Containerfile .
     fi
   done
   podman-compose -f '${COMPOSE[$TARGET]}' up -d