Server: do not trust things external things in the dist-cache

Only copy over files without external soruces (notably duckpan.js, at
present)... everything else is either gotten fresh or cache-checked.

I don't even know how these managed to get distributed to me, but ah,
well.