Reconcile production source and release provenance

[kuker24]

Why production diverged

/opt/siab1 is a file-based release, not a Git checkout. The 2026-08-28 delta deploy of 72aa010 copied five PR #2 files correctly, then generated a full-tree checksum over mixed runtime files. That labeled a delta as full commit identity.

Compared against origin/main@72aa0107727309c528bf5be825b07fbe5a2b1eb0 there were 57 source divergences and 0 unexplained after classification.

Legitimate production change reconstructed

• scripts/go_remaining_stage0.py now sends SEB headers for autosave, batch, and submit, matching Go SXB protected paths.

Intentional runtime differences (not copied into Git)

Keep Git FastAPI N=4 admission, singleflight, telemetry, and query hardening. Production still runs older control-plane Python bind-mounted under /opt/siab1/app because student traffic is Go 100%. Reverse-copying those files would regress the FastAPI fallback.

Git-only control-plane modules remain: app/core/singleflight.py, app/core/start_db_admission.py, app/middleware/start_admission_bind.py, plus local parity/fingerprint probes.

Operational artifacts excluded

Nginx .bak / .pre-* files, generated JS bundles, live runtime_control/ maps, logs, uploads, backups, and secrets are excluded from source identity.

Stale drift left in Git as canonical

CRLF-only frontend/CSS/template drift and older bin/restore.sh stay Git-canonical. Do not reverse-copy production bytes.

Runtime

No production deploy, restart, rebuild, or routing change was performed. Public critical smoke remains 9/9.

Future release identity

• scripts/source_release_fingerprint.sh is the deterministic source snapshot.
• scripts/generate_release_manifest.sh now records release_mode=full|delta and will not treat a delta as full-tree commit identity.
• Future image builds can receive OCI revision/source/version/created labels. Current production images were not rebuilt.