refactor: reset kernel source to tag between build iterations

Four folded changes, all aimed at making the build loop safe to run
when source files have been mutated by a previous iteration and
producing clear errors when tag resolution fails:

* Replace `git checkout <tag>` with `git reset --hard <tag>` followed by
  `git clean -fdx` (extracting the tag into a local variable).
* Bail with a clear error if `get_tag` finds no matching tag, so the
  build doesn't fall through to `git reset --hard ""`.
* Move the config copy to after the reset so it isn't clobbered by
  `git clean`.
* Drop the now-redundant `make distclean || true` at the top of the
  script — `git clean -fdx` inside `build_version` strictly subsumes it.

Behavior is identical for the no-patches case (the tag tree is unchanged
so reset is a no-op). Prep work for applying out-of-tree patches.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Signed-off-by: Nikita Kalyazin <nikita.kalyazin@e2b.dev>

Author: kalyazin

build.sh

@@ -45,12 +45,20 @@ function build_version {
   local version=$1
   echo "Starting build for kernel version: $version (${TARGET_ARCH})"
 
+  local tag
+  tag="$(get_tag "$version")"
+  if [ -z "$tag" ]; then
+    echo "ERROR: no Amazon Linux kernel tag matches version '$version'" \
+         "(looked for microvm-kernel-${version}-*.amzn2 or kernel-${version}-*.amzn2)" >&2
+    exit 1
+  fi
+  echo "Resetting kernel source to tag: $tag"
+  git reset --hard "$tag"
+  git clean -fdx
+
   # Configs live in configs/{arch}/
   cp ../configs/"${TARGET_ARCH}/${version}.config" .config
 
-  echo "Checking out repo for kernel at version: $version"
-  git checkout "$(get_tag "$version")"
-
   # Set up cross-compilation if building arm64 on x86_64
   local make_opts=""
   if [[ "$TARGET_ARCH" == "arm64" ]]; then
@@ -92,8 +100,6 @@ install_dependencies
 [ -d linux ] || git clone --no-checkout --filter=tree:0 https://github.com/amazonlinux/linux
 pushd linux
 
-make distclean || true
-
 grep -v '^ *#' <../kernel_versions.txt | while IFS= read -r version; do
   build_version "$version"
 done