Verify a production change

Merged is not deployed, and deployed is not verified.

Gate on the deploy

• Read a commit sha, not a version string, from whatever the service exposes (status endpoint, build-info route, bootstrap manifest).

• Fetch before comparing. An ancestry check against a commit the clone has never seen reports a false negative.

• Compare by ancestry, never equality:

  git merge-base --is-ancestor "$TARGET" "$DEPLOYED"
  

  Equality fails as soon as a later deploy lands, though that deploy still carries the change. Ancestry also keeps the gate closed after a rollback.