feat(dirty-content-fingerprint): xceadmin build-info module gains fingerprint

Threads dirty_fingerprint through as an 8th positional arg from
xceadmin/meson.build's custom_target into meson-build.sh, which adds
DIRTY_FINGERPRINT to the generated _build_info.py with an independent
empty-string fallback (not "unknown", matching this feature's convention
everywhere else). GIT_COMMIT/BUILD_TIME's existing generation and
"unknown" fallback are completely untouched.

Verified independently by review across three full real build+test+wheel
cycles: dirty tree produces a real, non-empty fingerprint present
identically in the mirrored tree, build/lib copy, an installed venv, and
the packaged wheel, cross-checked byte-for-byte against that same build's
compile_commands.json; explicit-empty fingerprint with real commit/time
resolves DIRTY_FINGERPRINT to genuinely empty; all-empty scenario confirms
the two fallback conventions ("unknown" vs empty) coexist without
interference. 261 passed/3 skipped throughout.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

src/xceadmin/meson-build.sh

@@ -26,6 +26,9 @@ GIT_COMMIT="$6"    # build-time-versioning task 5.1: get_option('commit_id'),
                     # resolved by xce-build.sh (task 2.1) -- empty if meson was
                     # invoked without -Dcommit_id= (e.g. a bare `meson setup`)
 BUILD_TIME="$7"    # build-time-versioning task 5.1: get_option('build_time'), same as above
+DIRTY_FINGERPRINT="$8"  # dirty-content-fingerprint task 5.1: get_option('dirty_fingerprint'),
+                    # resolved by xce-build.sh (task 2.1) / flake.nix (task 2.2) -- empty if
+                    # meson was invoked without -Ddirty_fingerprint= or the tree is clean
 
 # Requirement 1.4 / 4.2: never hand the mirrored tree a genuinely empty
 # value -- fall back to the literal "unknown", same empty -> "unknown"
@@ -37,6 +40,16 @@ fi
 if [ -z "$BUILD_TIME" ]; then
     BUILD_TIME=unknown
 fi
+# dirty-content-fingerprint task 5.1: DIRTY_FINGERPRINT's fallback is a
+# plain empty string, deliberately NOT "unknown" -- independent of the two
+# fallbacks above and matching this feature's convention everywhere else
+# (go_build's XCE_DIRTY_FINGERPRINT, the C daemons' dirty_fingerprint). An
+# already-empty $8 needs no action; this guard only protects against an
+# unset positional (e.g. a hand-invoked meson-build.sh missing the arg
+# entirely) under `set -u`.
+if [ -z "${DIRTY_FINGERPRINT:-}" ]; then
+    DIRTY_FINGERPRINT=""
+fi
 
 SRC_DIR="$REPO_ROOT/src"
 
@@ -77,13 +90,15 @@ cp "$SRC_DIR/configs/schema/"*.schema.json "$SCHEMA_DST/json/"
 BUILD_INFO_DST="$WORK_DIR/src/xceadmin/_build_info.py"
 echo "=== xceadmin (meson): writing generated build-info module ==="
 cat > "$BUILD_INFO_DST" <<EOF
-# Generated by meson-build.sh (build-time-versioning task 5.1) -- do not edit.
+# Generated by meson-build.sh (build-time-versioning task 5.1, extended by
+# dirty-content-fingerprint task 5.1) -- do not edit.
 # Overwritten on every meson build; never checked in. See
 # src/xceadmin/src/xceadmin/_build_info.py (task 5.2) for the committed,
-# "unknown"-only fallback stub used by \`pip install -e .\` editable installs,
-# which never run this script.
+# fallback stub used by \`pip install -e .\` editable installs, which never
+# run this script.
 GIT_COMMIT = "$GIT_COMMIT"
 BUILD_TIME = "$BUILD_TIME"
+DIRTY_FINGERPRINT = "$DIRTY_FINGERPRINT"
 EOF
 
 # Requirement 4.2: never silently proceed to pip install/pytest/wheel-build

src/xceadmin/meson.build

@@ -50,6 +50,14 @@ xceadmin_stamp = custom_target('xceadmin',
     # XCE_GIT_COMMIT/XCE_BUILD_TIME handling.
     get_option('commit_id'),
     get_option('build_time'),
+    # dirty-content-fingerprint task 5.1: third positional arg, same
+    # resolved-option-value style as commit_id/build_time above. Unlike
+    # those two, its meson-build.sh-side fallback on empty is a plain empty
+    # string, NOT "unknown" -- matching this feature's convention
+    # everywhere else (go_build's XCE_DIRTY_FINGERPRINT, the C daemons'
+    # dirty_fingerprint), not the original feature's commit_id/build_time
+    # convention.
+    get_option('dirty_fingerprint'),
   ],
   build_by_default: true,
   build_always_stale: true,