perf: skip go rebuild if sources unchanged, use rsync for ISO download

- audit binary is only rebuilt when .go files are newer than the binary
- rsync replaces scp for ISO download (delta transfer on repeat builds)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

iso/builder/build-debug.sh

@@ -33,15 +33,27 @@ echo "Alpine: ${ALPINE_VERSION}, Go: ${GO_VERSION}"
 echo ""
 
 # --- compile audit binary (static, Linux amd64) ---
-echo "=== building audit binary ==="
-cd "${REPO_ROOT}/audit"
-GOOS=linux GOARCH=amd64 CGO_ENABLED=0 \
-    go build \
-    -ldflags "-s -w -X main.Version=debug-$(date +%Y%m%d)" \
-    -o "${DIST_DIR}/bee-audit-linux-amd64" \
-    ./cmd/audit
-echo "binary: ${DIST_DIR}/bee-audit-linux-amd64"
-echo "size:   $(du -sh "${DIST_DIR}/bee-audit-linux-amd64" | cut -f1)"
+# Skip rebuild if binary is newer than all Go source files.
+AUDIT_BIN="${DIST_DIR}/bee-audit-linux-amd64"
+NEED_BUILD=1
+if [ -f "$AUDIT_BIN" ]; then
+    NEWEST_SRC=$(find "${REPO_ROOT}/audit" -name '*.go' -newer "$AUDIT_BIN" | head -1)
+    [ -z "$NEWEST_SRC" ] && NEED_BUILD=0
+fi
+
+if [ "$NEED_BUILD" = "1" ]; then
+    echo "=== building audit binary ==="
+    cd "${REPO_ROOT}/audit"
+    GOOS=linux GOARCH=amd64 CGO_ENABLED=0 \
+        go build \
+        -ldflags "-s -w -X main.Version=debug-$(date +%Y%m%d)" \
+        -o "$AUDIT_BIN" \
+        ./cmd/audit
+    echo "binary: $AUDIT_BIN"
+    echo "size:   $(du -sh "$AUDIT_BIN" | cut -f1)"
+else
+    echo "=== audit binary up to date, skipping build ==="
+fi
 
 # --- inject authorized_keys for SSH access ---
 # Uses the same Ed25519 keys as release signing (from git.mchus.pro/mchus/keys).