perf: skip go rebuild if sources unchanged, use rsync for ISO download

- audit binary is only rebuilt when .go files are newer than the binary
- rsync replaces scp for ISO download (delta transfer on repeat builds)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

iso/builder/build-debug.sh

@@ -33,15 +33,27 @@ echo "Alpine: ${ALPINE_VERSION}, Go: ${GO_VERSION}"
 echo ""
 
 # --- compile audit binary (static, Linux amd64) ---
-echo "=== building audit binary ==="
+# Skip rebuild if binary is newer than all Go source files.
-cd "${REPO_ROOT}/audit"
+AUDIT_BIN="${DIST_DIR}/bee-audit-linux-amd64"
-GOOS=linux GOARCH=amd64 CGO_ENABLED=0 \
+NEED_BUILD=1
-    go build \
+if [ -f "$AUDIT_BIN" ]; then
-    -ldflags "-s -w -X main.Version=debug-$(date +%Y%m%d)" \
+    NEWEST_SRC=$(find "${REPO_ROOT}/audit" -name '*.go' -newer "$AUDIT_BIN" | head -1)
-    -o "${DIST_DIR}/bee-audit-linux-amd64" \
+    [ -z "$NEWEST_SRC" ] && NEED_BUILD=0
-    ./cmd/audit
+fi
-echo "binary: ${DIST_DIR}/bee-audit-linux-amd64"
+
-echo "size:   $(du -sh "${DIST_DIR}/bee-audit-linux-amd64" | cut -f1)"
+if [ "$NEED_BUILD" = "1" ]; then
+    echo "=== building audit binary ==="
+    cd "${REPO_ROOT}/audit"
+    GOOS=linux GOARCH=amd64 CGO_ENABLED=0 \
+        go build \
+        -ldflags "-s -w -X main.Version=debug-$(date +%Y%m%d)" \
+        -o "$AUDIT_BIN" \
+        ./cmd/audit
+    echo "binary: $AUDIT_BIN"
+    echo "size:   $(du -sh "$AUDIT_BIN" | cut -f1)"
+else
+    echo "=== audit binary up to date, skipping build ==="
+fi
 
 # --- inject authorized_keys for SSH access ---
 # Uses the same Ed25519 keys as release signing (from git.mchus.pro/mchus/keys).

scripts/run-builder.sh

@@ -56,7 +56,8 @@ echo ""
 echo "=== downloading ISO ==="
 LOCAL_ISO_DIR="${REPO_ROOT}/iso/out"
 mkdir -p "${LOCAL_ISO_DIR}"
-scp -o StrictHostKeyChecking=no \
+rsync -az --progress \
+    -e "ssh -o StrictHostKeyChecking=no" \
     "root@${BUILDER_HOST}:/root/bee/dist/*.iso" \
     "${LOCAL_ISO_DIR}/"
 echo ""