[fly1d]

--prebuilt treats a cached source tree as a completed binary download.
After a failed --source build it copies that tree into the environment;
when both source and prebuilt trees remain, copying finds multiple matches.

Keep source reuse for source builds, and require the version’s trailing -
when locating a prebuilt tree. Binary downloads and the arm64-to-x64 fallback
retain their behavior. The branch includes current master (2226040),
including release 1.11.1 and the fish activation fix. The #443 changelog
entry remains under unreleased.

Fixes #443.

• Tests cover cache combinations, platform layouts, version prefixes
  and x64 fallback with real directory copying
• CHANGES has an unreleased entry
• README.rst needs no change
• Title uses type(scope): subject
• Current tox -e py314: 403 passed, 61 skipped, 11 integration tests
  deselected; flake8 passed

On the current unchanged upstream code, the identical nine focused cases
have five failures and four passes; all nine pass within the complete
suite with this fix. Five fresh CLI scenarios using a local HTTP mirror
and stub archives pass, covering source-failure retries, both retained
trees, source-cache reuse, activation and a real HTTP404 x64 fallback.
Current upstream passes two of those five scenarios. These are local
Python 3.14.7/macOS checks; unavailable fish and platform cases were
skipped, and the remote platform matrix was not run locally.

Earlier native validation on head ae1f32c used the official
Node.js 24.0.0 archive, verified against its
published SHA256.
With a seeded source cache, it installed and ran Node.js 24.0.0 and npm
11.3.0; --no-clean-src retained both trees and a subsequent forced
--clean-src install removed src. That native validation was not rerun
for this changelog reconciliation; Node.js source compilation was not
exercised.

#447 changes the same glob line to escape literal path characters. An
earlier isolated combination retained both fixes and passed 18 focused
cases plus the five CLI scenarios under a bracketed temporary path.
Combining the changes still needs to retain both glob.escape and -*.

[ekalinin]

Thanks!