#67 build never cleans out/: deleted issues/files keep being served

run_build never cleans the output directory — it only create_dir_alls the subdirs it needs. Anything a previous build wrote and the current build no longer produces stays on disk and keeps being served.

Verified:

$ hu13 build . -o out                       # issue 2222… exists -> issues/2222….html
$ git rm -r .forge/issues/2222… && hu13 build . -o out
$ ls out/issues/
22222222-2222-4222-8222-222222222222.html    # still there, still served by `serve`/Pages
$ grep -l "secret body" out/issues/*.html
out/issues/22222222-2222-4222-8222-222222222222.html

Same for deleted repo files (raw/, files/), closed/renamed commits, removed wiki pages and releases. repo.git is removed explicitly since #54, everything else is not.

Consequences: "delete an issue" and "close/rename a page" do not unpublish; a Pages deploy of a stale dist/ quietly keeps removed content reachable by URL. For an inbox-adjacent project that is a privacy bug, not just tidiness.

Fix options:

• clean by default: remove out (or its known subtrees) at the start of run_build, with --no-clean for incremental debugging. The entrypoint always builds into a fresh /srv/www, so this is safe there.
• or build into a temp dir and swap (atomic-ish), which also fixes half-written output when a build fails midway.

Acceptance:

• deleting an issue/file and rebuilding leaves no page for it in out
• a failed build never leaves a half-updated served tree
• documented: build cleans or the flag exists