fix(security): harden image context and runtime receipts

.gitea/workflows/cd.yaml

@@ -41,6 +41,7 @@ on:
       - 'monitoring/blackbox.yml'
       # 需重建 image 的檔案
       - 'Dockerfile'
+      - '.dockerignore'
       - 'requirements.txt'
       - 'docker-compose.yml'
       # 腳本工具
@@ -108,7 +109,7 @@ jobs:
             exit 0
           fi
           CHANGED=$(git diff --name-only HEAD~1 HEAD 2>/dev/null || echo "")
-          if echo "$CHANGED" | grep -qE '^(Dockerfile|requirements\.txt|docker-compose\.yml)$'; then
+          if echo "$CHANGED" | grep -qE '^(Dockerfile|\.dockerignore|requirements\.txt|docker-compose\.yml)$'; then
             echo "type=rebuild" >> $GITHUB_OUTPUT
             echo "label=🔨 重建 Docker Image" >> $GITHUB_OUTPUT
           else
@@ -129,7 +130,14 @@ jobs:
           fi
 
       - name: 資訊安全與治理 release gate
+        env:
+          GITEA_SHA: ${{ gitea.sha }}
         run: |
+          set -eu
+          mkdir -p governance
+          python3 scripts/ops/report_security_governance_review.py \
+            --strict --source-commit "$GITEA_SHA" \
+            > governance/security_governance_source_receipt.json
           python3 scripts/ops/report_security_governance_review.py --compact --strict
 
       # 設定 SSH 金鑰 + 主機驗證（C2 fix: 移除 StrictHostKeyChecking no）