Fix Tower release source and image identity

scripts/deploy_tower.ps1

@@ -2,7 +2,7 @@ param(
     [string]$RemoteHost = "root@192.168.10.150",
     [string]$RemotePath = "/mnt/user/appdata/geointel",
     [string]$RemoteBranch = "main",
-    [string]$RemoteRepo = "git@gitea.itworx.tech:Jens/geointel.git",
+    [string]$RemoteRepo = "gitea-widefrog:Jens/geointel.git",
     [string]$SshKey = "$HOME/.ssh/itworx_unraid_deploy",
     [string]$FrontendUrl = "http://192.168.10.150:1202",
     [string]$InstallAi = $(if ($env:GEOINTEL_INSTALL_AI) { $env:GEOINTEL_INSTALL_AI } else { "" }),
@@ -42,6 +42,12 @@ git branch -M "$REMOTE_BRANCH"
 git clean -fd -- backend frontend deploy scripts fixtures tests contracts demo
 chmod +x scripts/*.sh backend/docker_start.sh deploy/unraid/*.sh || true
 
+# Persistent runtime roots can legitimately contain untracked files. The
+# deploy checkout nevertheless has an exact, freshly fetched source revision
+# because every image-bearing source path was reset and cleaned above.
+DEPLOY_BUILD_SHA="$(git rev-parse HEAD)"
+
+GEOINTEL_BUILD_SHA="$DEPLOY_BUILD_SHA" \
 FRONTEND_URL="$FRONTEND_URL" \
 DEPLOY_GEOINTEL_INSTALL_AI="${DEPLOY_GEOINTEL_INSTALL_AI:-}" \
 bash deploy/unraid/deploy-release.sh