build.prebuild and a Capacitor web-asset staleness guard for apple build / play build

apple build and play build run build.prebuild (or apple.prebuild / play.prebuild) first, once per flow run;
--no-prebuild skips it, --dry only prints it. A Capacitor project's copied public/index.html must then be newer
than the last source commit and <webDir>/index.html, else the build stops (--allow-stale-web overrides). check
warns when stale without a prebuild; the build output and dry plan show the web bundle's sha256 and mtime.
The Capacitor project is also found in a monorepo (apps/native etc.); several ask for play.build.dir /
apple.build.*. Pitfall 23.

cli/data/flags.json

@@ -56,10 +56,12 @@
   ],
   "apple appinfo": [],
   "apple build": [
+   "allow-stale-web",
    "build-number",
    "configuration",
    "keychain",
    "no-install",
+   "no-prebuild",
    "out",
    "project",
    "scheme",
@@ -379,9 +381,11 @@
    "threshold"
   ],
   "play build": [
+   "allow-stale-web",
    "dir",
    "flavor",
    "module",
+   "no-prebuild",
    "out",
    "version-code",
    "version-name"
@@ -655,6 +659,7 @@
    "agent",
    "all",
    "all-pages",
+   "allow-stale-web",
    "alpha",
    "apk",
    "app",
@@ -759,6 +764,7 @@
    "no-install",
    "no-local",
    "no-mcp",
+   "no-prebuild",
    "no-save",
    "no-scan",
    "no-sheet",