v0.316.4: build.sh refuses a push from a dirty or unpushed tree

An admission and its mechanism. Building 0.316.3 published another session's work: the shared
DooPlex clone held 31 uncommitted files, and the build directory's build.sh is a symlink into that
clone's WORKING COPY — which predated the FELHOM_REPO_DIR override, so the override was ignored and
the build copied the shared tree. The banner printed 'Commit: 0225255' and no 'Repo:' line; the
evidence was on screen and the image was already pushed. Nobody deployed it, which is luck, not a
control.

The clean-tree rule has been a sentence in a runbook all along. A rule without a mechanism is a
wish, so it is now two questions the build asks and refuses on: is every tracked file committed,
and is HEAD what origin/main has. A directory that is not a git checkout is refused too — a build
whose source cannot be identified is not reproducible.

Four new cases in the test (ten in total), each driving the real script; red-proved by deleting the
gate, which fails all four.

0.316.3 must never be deployed. It is not re-pushed or deleted: a version number is pushed once,
and that applies to a number I spoiled.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0117kRTSgs3rJWUFGxyoWN6Y

CHANGELOG.md

@@ -1,3 +1,21 @@
+## v0.316.4 — the clean-tree gate is a mechanism, not a sentence (2026-10-15)
+
+**MinAgent: 0.155.0** (unchanged). **Do not deploy `0.316.3`** — see below.
+
+- **`build.sh` refuses `--push` from a tree that is dirty or not at `origin/main`**, and from a
+  directory that is not a git checkout at all. Four more cases in
+  `scripts/test_build_push_once.sh` (ten in total), red-proved by deleting the gate.
+- **Why, and it is an admission.** Building 0.316.3 published another session's work. The shared
+  DooPlex clone held 31 uncommitted files (the physical-disk storage work); the build directory's
+  `build.sh` is a symlink into that clone's WORKING COPY, which predated the `FELHOM_REPO_DIR`
+  override, so the override was silently ignored and the build copied the shared tree. The banner
+  said `Commit: 0225255` with no `Repo:` line — the evidence was on screen and the image was
+  already pushed. **Nobody deployed it; that was luck, not a control.** The clean-tree rule existed
+  only as a sentence in a runbook, and a rule without a mechanism is a wish.
+- **`0.316.3` must never be deployed.** It carries another session's unreleased code under this
+  repo's version number. It is not re-pushed or deleted — a version number is pushed once, and that
+  applies to a number I spoiled. R-1082.
+
 ## v0.316.3 — the app page as one column, finished (2026-10-15)
 
 - **The column sat too far from the top and the sidebar.** `.app-page` carried the mockup's