fix(abi): capture pristine ABI right after kernel download

- Was after Kernel Fixes (so fixes could hide ABI drift). Now
  Download -> Capture source (pristine) -> Set Timestamp ->
  Extract -> Kernel Fixes -> Verify root etc.
- 5-gate order is now: 1) Capture source (pristine, right after
  clone), 2) Verify root, 3) Capture blessed after features,
  4) Verify NoMount, 5) Final verify. Unchanged otherwise.

.github/workflows/build.yml

@@ -125,6 +125,12 @@ jobs:
         kernel_version: ${{ inputs.kernel_version }}
         os_patch_level: ${{ inputs.os_patch_level }}
 
+    - name: Capture source ABI/KMI safeguards
+      if: ${{ inputs.preserve_abi }}
+      uses: ./.github/actions/abi-kmi-safeguards
+      with:
+        mode: capture
+
     - name: Set Build Timestamp from Kernel Commit
       shell: bash
       run: |
@@ -171,12 +177,6 @@ jobs:
         sublevel: ${{ steps.extract.outputs.sublevel }}
         os_patch_level: ${{ inputs.os_patch_level }}
 
-    - name: Capture source ABI/KMI safeguards
-      if: ${{ inputs.preserve_abi }}
-      uses: ./.github/actions/abi-kmi-safeguards
-      with:
-        mode: capture
-
     - name: Setup Selected Root Implementation
       if: ${{ inputs.root_flavor != '' }}
       uses: ./.github/actions/root-setup