build-sequence: check the recorded source provider before building #1418

Problem

download-sequence checks that each entry's recorded source_provider matches the current settings, and fails early with a clear message if not (download_sequence.py#L76-L92).

build-sequence replays the same build order but has no such check (build.py#L178-L185). If the settings changed since the build order was written, the recorded URL goes to the wrong downloader. For example, a github-tag-git order replayed under pypi-download settings sends a git+https://... URL to the plain downloader and fails with InvalidSchema or a 404 instead of "settings don't match this build order".

Fix

Move the check into a shared helper and call it from both commands right after reading the build order. Keep the _skip_recorded_url logic in download-sequence, since it only applies to replaying downloads.

Add a test for build-sequence with a mismatched provider.

Non-blocking for #1414. Reported in review of #1414.