完善(08-09-deployment-contract-single-source-harness): 收敛部署合同并补失败路径

deploy/trialrun/check-source-provenance.mjs

@@ -18,6 +18,17 @@ const ALLOWED_UNPUBLISHED_REASONS = new Set([
   "controlled-local-recovery",
 ]);
 
+export function deriveCandidateBuildEnv(commit) {
+  const normalized = String(commit ?? "").trim();
+  if (!/^[0-9a-f]{40,64}$/u.test(normalized)) {
+    throw new SourceProvenanceError("commit_invalid");
+  }
+  return Object.freeze({
+    BUILD_SHA: normalized,
+    VITE_BUILD_SHA: normalized.slice(0, 12),
+  });
+}
+
 function runGit(rootDir, args) {
   return spawnSync("git", args, {
     cwd: rootDir,
@@ -50,6 +61,7 @@ export function collectSourceProvenance({ rootDir, allowUnpublished = false }) {
   }
 
   const commit = gitText(rootDir, ["rev-parse", "--verify", "HEAD"], "commit_unavailable");
+  const buildEnv = deriveCandidateBuildEnv(commit);
   const branch = gitText(rootDir, ["branch", "--show-current"], "branch_unavailable") || "detached";
   const upstreamResult = runGit(rootDir, ["rev-parse", "--abbrev-ref", "--symbolic-full-name", "@{upstream}"]);
   const upstream = upstreamResult.status === 0 ? upstreamResult.stdout.trim() : null;
@@ -64,8 +76,9 @@ export function collectSourceProvenance({ rootDir, allowUnpublished = false }) {
 
   return {
     status: "PASS",
-    commit,
-    shortCommit: commit.slice(0, 12),
+    commit: buildEnv.BUILD_SHA,
+    shortCommit: buildEnv.VITE_BUILD_SHA,
+    buildEnv,
     branch,
     upstream,
     published,