Deploy guard: build_app_bundle refuses stale/unrecorded trees — recorded main is canonical for the served dist

[aarontrowbridge]

Important

Problem — The 2026-09-10 deploy race: Aaron's local-tree deploy (build_app_bundle.mjs, built at 10:06 EDT from a tree predating #988) overwrote the recorded-main dist-app swap, and the tool-count-label crash (#987) returned — an unrecorded local build served over a recorded fix. Same doctrine class as #964 (the fork→overlay sync clobber): recorded main is canonical; anything deploying stale or unrecorded state must fail loudly.
Approach — Guard the deploy flow itself:

1. Pre-flight in build_app_bundle.mjs: fetch origin; refuse (exit 1, named reason + remedy) if HEAD ≠ origin/main or the tree is dirty. Override: AMICODE_DEPLOY_OVERRIDE=<reason> — the override is REQUIRED to be non-empty and is recorded in the deploy manifest (honest hotfixes, never silent ones).
2. The deploy manifest: every deploy stamps dist-app/deploy.json — {commit, branch, dirty, override_reason, built_at, deployed_by} — so any served bundle traces to a recorded commit (the anti-Sync-reconciliation: the fork→overlay sync clobbers amicode-side fixes (#929's fix regressed by ff7b69c8; the diff_version fix owes a fork mirror) #964 rule: no unrecorded fixes on the serving path).
3. The known-fixes check at deploy time: run the Sync-reconciliation: the fork→overlay sync clobbers amicode-side fixes (#929's fix regressed by ff7b69c8; the diff_version fix owes a fork mirror) #964 known-fixed-hunks guard (or inline hunk checks) pre-deploy — a build from a tree missing a known fix refuses with the same named-remedy shape.
4. Locate build_app_bundle.mjs first — repo script or ops state (~/.amico/ops|devtools): if repo, PR per the gate; if ops, the same guard + this issue as the record.

Doctrine: reference-20260907-021500-agentic-substrate-doctrine (recorded state is canonical) + #964 (the sync-side sibling — the overlay-sync canonical rule stays on #964's plate).