Clear stale intermediates from the persistent work dir

Build 18744 died at "Building filesystems" with:

    mkfs.vfat: file /work/esp.img already exists

esp.img was left there by build 18700, which was cancelled during compression
and so never reached its end-of-build cleanup. Making $WORK persist so the
staged base could be reused made everything else in it persist as well, and
that turns out not to be inert: mkfs.vfat -C refuses to overwrite, and
`mv $ROOTFS/boot $WORK/boot` would have nested inside a surviving directory
rather than replacing it — a subtler failure that would have produced a /boot
filesystem containing a stray boot/ subdirectory.

Clear the work directory at the start of each run, keeping only the staged base
and its stamp, so the invariant is stated positively rather than depending on
the previous run having exited cleanly. Cleanup that only runs on success is
not cleanup.

Also record why 95-set-boot-entry.install exits 1 during the transaction, so
the next person to read a build log does not go hunting. It is a consequence of
suppressing initramfs generation, is confined to the build, and cannot occur on
the device.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01XWRjNJMistCy6ngXH5aJLS

build/stage2.sh

@@ -58,6 +58,15 @@ bind() { mount --bind "$1" "$2" && MOUNTED+=("$2"); }
 
 mkdir -p "$WORK" "$DNF_CACHE"
 
+# $WORK persists between builds so the staged base can be reused — which means
+# everything else in it persists too, including intermediates from a build that
+# was cancelled or failed before its cleanup ran. That is not inert: mkfs.vfat
+# -C refuses to overwrite an existing file, and `mv dir $WORK/boot` nests inside
+# a surviving directory rather than replacing it. So state the invariant
+# positively — only the staged base and its stamp survive a new run.
+find "$WORK" -mindepth 1 -maxdepth 1 \
+     ! -name base ! -name base.stamp -exec rm -rf {} +
+
 # ---------------------------------------------------------------------------
 # Build tooling. Every dnf transaction in here runs emulated, so the prebuilt
 # base image (gongfoo's build-fedora-44-aarch64) carries these already and this
@@ -129,6 +138,12 @@ else
     # config. Both 50-dracut.install and 51-dracut-rescue.install bail out when
     # KERNEL_INSTALL_INITRD_GENERATOR is anything other than "dracut".
     #
+    # Expected side effect: with no initramfs present, 95-set-boot-entry.install
+    # logs "Error: /boot/initramfs-<kver>.img not found" and exits 1 during the
+    # transaction. rpm reports the scriptlet failure and carries on. It does not
+    # matter here — stage2 writes its own BLS entry below — and it cannot happen
+    # on the device, where this file is gone and dracut runs normally.
+    #
     # This file must not survive into the image — see the removal after the
     # working copy is made.
     mkdir -p "$BASE/etc/kernel"