Detect aarch64 rebuilds, including against carried dependencies

sync-rebuilds followed PUBLISHED_ARCHES (x86_64 by default), so the scheduled
run skipped every aarch64-only package, and it read aarch64 triggers from Arch
Linux ARM even when this repository carries them. It now follows the
architectures a merge builds (CI_ARCHES, shared with build-matrix), and reads a
carried trigger from its recipe once edge publishes that version; until then
its dependents wait. Published databases are verified before use and loaded
once per run.

bin/build-matrix

@@ -19,7 +19,7 @@ BUILD_ROOT=$(realpath "${BASH_SOURCE[0]%/*}/..")
 source "$BUILD_ROOT/helpers/paths.sh"
 source "$BUILD_ROOT/helpers/package-metadata.sh"
 
-ARCHES=${CI_ARCHES:-x86_64 aarch64}
+ARCHES=$CI_ARCHES
 if [[ "${1:-}" == --arch ]]; then [[ $2 == all ]] || ARCHES=$2; shift 2; fi
 for a in $ARCHES; do require_valid_arch "$a"; done