build.prebuild and a Capacitor web-asset staleness guard for apple build / play build

apple build and play build run build.prebuild (or apple.prebuild / play.prebuild) first, once per flow run;
--no-prebuild skips it, --dry only prints it. A Capacitor project's copied public/index.html must then be newer
than the last source commit and <webDir>/index.html, else the build stops (--allow-stale-web overrides). check
warns when stale without a prebuild; the build output and dry plan show the web bundle's sha256 and mtime.
The Capacitor project is also found in a monorepo (apps/native etc.); several ask for play.build.dir /
apple.build.*. Pitfall 23.

CHANGELOG.md

@@ -2,6 +2,21 @@
 
 ## Unreleased
 
+- Fix (`apple build`, `play build`, Capacitor): a native build no longer ships old web assets silently. New
+  `build.prebuild` (per store `apple.prebuild` / `play.prebuild`): a shell command run in the project root before the
+  archive / bundle (e.g. `npm run build && npx cap sync`; printed, output streamed, nonzero exit stops the build,
+  `--dry` only prints it, `--no-prebuild` skips it, once per `flow run` instead of once per store). After it, the
+  copied `ios/App/App/public/index.html` / `android/app/src/main/assets/public/index.html` must be newer than the last
+  git commit outside ios/ android/ node_modules/ store/ .storebound/ and `<webDir>/index.html`, else the build stops
+  with "web assets are older than the source (copied ..., source ...)"; `--allow-stale-web` overrides. `check` warns
+  when they are stale and no prebuild is set. The build output and the dry-run plan (`web` in `--json`) show the web
+  bundle that went in: sha256 (12 hex) and mtime of the copied index.html. Pitfall 23.
+  - Monorepos: `play build` failed with "no Gradle project (settings.gradle) in android or ." when the Capacitor app
+    lives in `apps/native` (capacitor.config.ts, android/, ios/ there). `apple build`, `play build`, the staleness
+    check and `check` now use the root's capacitor.config.*, else the one found one or two levels down (package.json
+    workspaces, apps/*, packages/*, direct child folders; node_modules skipped) and name it ("Capacitor project:
+    apps/native"). Several: they are listed and `play.build.dir` / `apple.build.workspace|project` is asked for; an
+    explicit config value always wins.
 - Fix (`play build`, `play upload`, `play release`): real AGP bundles (e.g. Capacitor 8) no longer fail with "AAB
   manifest without package / versionCode". The aapt2 proto manifest is read with Resources.proto's field numbers.
   Pitfall 22.