Produce a reproducible source tarball and verify that in pipeline

For inspiration and background see:

https://blog.josefsson.org/2024/04/01/towards-reproducible-minimal-source-code-tarballs-please-welcome-src-tar-gz/

https://blog.josefsson.org/2024/04/13/reproducible-and-minimal-source-only-tarballs/