fn source_changed_during_derivation(root: &Path, path: &str) -> CliError
Refuse publication when source bytes no longer match their staged node.