Deal with update checks, to see if upstream's rootfs tarballs have changed

[strugee]

And then don't run a build if we don't need to. It's probably not enough to rely on image hash because of the created label we add.