The installed smb.conf includes the build path in the defaults for dns update command. The final install path is not used as when the manpage is generated the is_install flag is set to false and so the internal path is used to satisfy the 'docs' test (checking default values). XML entities are used to ensure that these paths in the docs match the installed paths on the system. However, the entity generation in dynconfig/wscript depends on is_install but this is not marked as a dependency so it is not re-run for the 'final' manpages to be installed. Either that flag needs somehow to become a dependency or these parameters be skipped in the test and the is_install flag not respected in this case. Found by the debian reproducible builds effort: https://tests.reproducible-builds.org/debian/rb-pkg/unstable/amd64/diffoscope-results/samba.html
For cross-reference, Debian bug is https://bugs.debian.org/912340
It looks like this has been fixed quite some time ago. The patch proposed in debian still applies but the thing works fine now without, the path for SCRIPTSBINDIR is correctly propagated to the manpages, and the manpages are being correctly rebuilt during build procedure. The bug can be closed now.
Closing based on comment #2. I hope the build is now deterministic with the patches linked to bug 13213 (or https://gitlab.com/samba-team/samba/-/merge_requests/3652), though my tests for that did not include building from a different directory.