depends: sanity-check sources and cached builds

In some cases (Travis), sources and build caches may be moved around in-between
builds, and we can't necessarily trust that everything is still intact.

This introduces pre-build checks that verify against stashed checksums.

Note that this will cause all sources to be re-downloaded, since cached sources
weren't trustworthy before this.