fix(drift): read git state from gitea main

apps/api/tests/test_drift_detector_normalization.py

@@ -91,6 +91,56 @@ spec:
     assert service["spec"]["selector"]["system"] == "awoooi"
 
 
+def test_git_state_reader_prefers_gitea_main_raw_files(monkeypatch):
+    reader = GitStateReader("k8s")
+    remote_files = {
+        "k8s/awoooi-prod/kustomization.yaml": """
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: awoooi-prod
+commonLabels:
+  environment: prod
+  system: awoooi
+resources:
+  - deployment.yaml
+images:
+  - name: registry.local/library/api:IMAGE_TAG_PLACEHOLDER
+    newName: registry.local/awoooi/api
+    newTag: live-main-sha
+""",
+        "k8s/awoooi-prod/deployment.yaml": """
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: awoooi-api
+spec:
+  selector:
+    matchLabels:
+      app: awoooi-api
+  template:
+    metadata:
+      labels:
+        app: awoooi-api
+    spec:
+      containers:
+        - name: api
+          image: registry.local/library/api:IMAGE_TAG_PLACEHOLDER
+""",
+    }
+
+    def fake_fetch(settings, path):
+        return remote_files.get(path)
+
+    monkeypatch.setattr(reader, "_fetch_gitea_raw", fake_fetch)
+
+    state = reader._read_sync("awoooi-prod")
+
+    assert set(state) == {"Deployment/awoooi-api"}
+    container = state["Deployment/awoooi-api"]["spec"]["template"]["spec"]["containers"][0]
+    assert container["image"] == "registry.local/awoooi/api:live-main-sha"
+    assert state["Deployment/awoooi-api"]["spec"]["selector"]["matchLabels"]["system"] == "awoooi"
+
+
 def test_kubernetes_api_defaults_do_not_create_drift():
     detector = DriftDetector()
     git_res = {