fix(deploy): expose runtime build sha in production readback

docs/LOGBOOK.md

@@ -5,6 +5,7 @@
 - CD deploy marker `780260079 chore(cd): deploy a70c675 [skip ci]` 已把 `k8s/awoooi-prod/kustomization.yaml` 的 API/Web image tag 更新為 `a70c6756d9e76c33143676eef82bab7a49ac1839`。
 - Production `GET /api/v1/agents/delivery-closure-workbench` 已從 `source_count=5` 升到 `source_count=6` / `loaded_source_count=6`；GitHub operator governance writeback、KM、PlayBook、timeline、LOG counters 在 production API 讀回 ready。
 - `docs/operations/awoooi-production-deploy-readback-blocker.snapshot.json` 更新為 `status=closure_verified`、`production_image_tag_matches_main=true`、`production_governance_fields_present=true`、`non110_runner_cd_closure_ordered_completion_percent=100`、`blockers=[]`。
+- API image 透過 `AWOOOI_BUILD_COMMIT_SHA=$CACHE_BUST` 讀回 immutable build source SHA，避免 CD deploy marker commit 讓 production image tag 比對誤判為 stale。
 - `ops/runner/read-public-gitea-actions-queue.py` 補上 Gitea full row parser，現在可讀回最新 visible CD run id / status / commit SHA，避免再把 CD run 誤判成不可見。
 
 **邊界**：未讀 token / `.runner` 內容 / cookie / session / secret / auth / `.env`；未使用 GitHub；未手動 workflow_dispatch；未操作 host / Docker / K8s / runner service；未 force push。

docs/operations/awoooi-production-deploy-readback-blocker.snapshot.json

@@ -7,6 +7,8 @@
   "readback": {
     "observed_source_control_main_sha": "a70c6756d9e76c33143676eef82bab7a49ac1839",
     "observed_source_control_main_short_sha": "a70c6756d9",
+    "deploy_marker_commit_sha": "780260079e0b2fe7f5e9974304f69f4761620c0a",
+    "deploy_marker_commit_short_sha": "780260079",
     "governance_closure_merge_sha": "27b96f0450d0e3ca6651d6b5f274a341dd727ef2",
     "governance_closure_commit_sha": "9e3e7fbb6ba3ffd324b45abf3ad1e7b6ec826b22",
     "production_image_tag_sha": "a70c6756d9e76c33143676eef82bab7a49ac1839",