Fail early when worktree dirty

[samsalisbury]

Justification

Currently, when the worktree state changes from clean to dirty between the primary and verification builds, we end up with a failure about a failed upload due to a missing file. This is confusing and unhelpful. See this slack thread (internal only).

Summary

• All builds done by the action itself are now required to be of clean worktrees. (The CLI still allows dirty builds which is useful when working locally.)
• The error message about dirty worktrees has been enhanced to list the set of dirty paths so that it's easy to diagnose the issue and fix it.

Quality

All changes to behavior should be accompanied by relevant tests which both document and protect it.

This PR includes:

• New or updated tests which validate the new behavior. (Thank you!)
• New or updated behavior which has been manually tested. (Please provide a link to relevant logs if this is the case.)
• New or updated behavior which is not testable in a reasonable time frame. (Please ask for help if this is the case, more things are testable than we sometimes think!)
• No new or changed behavior. (Just documentation, configuration, or pure refactoring.)

[samsalisbury]

Self-review to aid other reviewers.

[samsalisbury]

This assertion required that crt.Product did not contain a slice (i.e. for it to be comparable). It's not really a necessary check anymore, since issues with the SourceHash would be flagged up by many different tests anyway.

[shore]

Looks good, just a couple minor comments :)

[shore]

👍