fix: link a build file only where it is recorded

Every source link on the site leads to a path the source record saw at
a commit. The Build file row linked pin_build files unchecked, eight of
them at commits the record did not hold. build_source_paths now records
the build files read at a commit, and the row links only those: a tag
can move and stays plain text. The record run also picked up two cited
paths it had not seen before (pom2 CMakeLists.txt, pcem configure.ac).

scripts/sitesources.py

@@ -321,9 +321,28 @@ def build_source_paths(
             # Recorded even when it holds no cited path, so a pinned tree
             # missing from the record is one no run has read.
             held.setdefault(tree_key(repo, pin), set()).update(paths & tree)
+        for repo, pin, path in build_files(profile):
+            tree = (_cached_tree(repo, pin, cache_dirs, fetch)
+                    or _listed_directories(repo, pin, {path}, cache_dirs, fetch))
+            if tree is None:
+                unread.add(tree_key(repo, pin))
+                continue
+            held.setdefault(tree_key(repo, pin), set()).update({path} & tree)
     return {key: sorted(paths) for key, paths in sorted(held.items())}, sorted(unread)
 
 
+def build_files(profile: dict) -> list[tuple[upstream.Repo, str, str]]:
+    """The platform build files `pin_build` names at a commit, as (repo,
+    revision, path). A tag can move, so a build read at a tag is not linked."""
+    found = []
+    for build in profile.get("pin_build") or []:
+        repo = _browse_repo(str(build.get("repo", "")))
+        revision = str(build.get("revision", ""))
+        if repo is not None and re.fullmatch(r"[0-9a-f]{40}", revision):
+            found.append((repo, revision, str(build.get("path", ""))))
+    return found
+
+
 def keep_unread(
     held: dict[str, list[str]], unread: list[str], previous: dict[str, list[str]]
 ) -> dict[str, list[str]]: