Function ensure_fresh 

pub fn ensure_fresh(
    home: &Path,
    cache_dir: &Path,
    identity: &Identity,
) -> Result<()>

Guarantee that a build against cache_dir from (worktree, head) never silently reuses another source’s compiled output: clean the workspace’s own packages out of the cache when the recorded identity disagrees, then record the new one. A no-op — no subprocess spawned — when the identity already matches, which is the common case once a cache directory settles on one worktree for a while.

Called with the lease already held: this is a mutation of the cache directory’s contents, and it must never race a concurrent build the same way a plain cargo clean run by hand would not.