I think file sets would help with this case https://nixos.org/manual/nixpkgs/stable/#sec-functions-library-fileset

There was an issue with them that caused them to not work well in nix pkgs (need to find the issue) but they should be fine for things outside nix pkgs

One way to work around this is to only bring in git-tracked files with something like lib.cleanSource or by using flakes (which only include tracked files when in a source-controlled directory).

Why is this way of “sucking in” a complete directory even available? Why not get rid of the foot-gun alltogether?

I don’t know the internals of nix, but only a subset of files are relocatable outside of their parent directory (and only a subset under their grandparent, and so on). Toolchains are kind of notorious for this so if you have a build system that only tracks files on their content and doesn’t have a way to require they stay put within a directory, you’re going to immediately hit bugs when using gcc or glibc.

For your toolkit: I have found nix-diff to be very good for debugging these sorts of mysterious rebuilds

I saw the bug, but that’s because I’ve shot myself in the foot with it too. I wish Nix had better tooling to catch these bad behaviors.