Fix Tower release source and image identity

scripts/deploy_tower.sh

@@ -4,7 +4,7 @@ set -euo pipefail
 REMOTE_HOST="${REMOTE_HOST:-root@192.168.10.150}"
 REMOTE_PATH="${REMOTE_PATH:-/mnt/user/appdata/geointel}"
 REMOTE_BRANCH="${REMOTE_BRANCH:-main}"
-REMOTE_REPO="${REMOTE_REPO:-git@gitea.itworx.tech:Jens/geointel.git}"
+REMOTE_REPO="${REMOTE_REPO:-gitea-widefrog:Jens/geointel.git}"
 SSH_KEY="${SSH_KEY:-$HOME/.ssh/itworx_unraid_deploy}"
 FRONTEND_URL="${FRONTEND_URL:-http://192.168.10.150:1202}"
 BOOTSTRAP="${DEPLOY_BOOTSTRAP:-0}"
@@ -45,6 +45,12 @@ git checkout -B "$REMOTE_BRANCH" "origin/$REMOTE_BRANCH"
 git clean -fd -- backend frontend deploy scripts fixtures tests contracts demo
 chmod +x scripts/*.sh backend/docker_start.sh deploy/unraid/*.sh || true
 
+# Persistent runtime roots can legitimately contain untracked files. The
+# deploy checkout nevertheless has an exact, freshly fetched source revision
+# because every image-bearing source path was reset and cleaned above.
+DEPLOY_BUILD_SHA="$(git rev-parse HEAD)"
+
+GEOINTEL_BUILD_SHA="$DEPLOY_BUILD_SHA" \
 FRONTEND_URL="$FRONTEND_URL" \
 DEPLOY_GEOINTEL_INSTALL_AI="${DEPLOY_GEOINTEL_INSTALL_AI:-}" \
 bash deploy/unraid/deploy-release.sh