fix(deploy): bind prepared source and scanned image exactly

backend/tests/test_rc5_release_deployment.py

@@ -74,8 +74,8 @@ def test_release_starts_only_the_locally_attested_ai_image() -> None:
 
     assert 'GEOINTEL_INSTALL_AI="${GEOINTEL_INSTALL_AI:-true}"' in script
     assert "Production release deployment requires the gated AI image" in script
-    assert 'bash scripts/generate_container_sbom.sh "$GEOINTEL_RELEASE_IMAGE"' in script
-    assert 'bash scripts/scan_container_image.sh "$GEOINTEL_RELEASE_IMAGE"' in script
+    assert 'bash scripts/generate_container_sbom.sh "$scanned_image_id"' in script
+    assert 'bash scripts/scan_container_image.sh "$scanned_image_id"' in script
     assert 'running_image_id="$(docker inspect --format \'{{.Image}}\' geointel)"' in script
     assert 'if [ "$running_image_id" != "$image" ]' in script
     assert "deployment-attestation.json" in script
@@ -83,6 +83,10 @@ def test_release_starts_only_the_locally_attested_ai_image() -> None:
     assert "GITEA_COMMIT_SHA" in script
     assert "GITHUB_SHA" in script
     assert "must contain one full 40-character Git commit SHA" in script
+    assert 'marker_path="$ROOT/.gitea-deploy/revision"' in script
+    assert "git rev-parse --show-toplevel" in script
+    assert "Prepared source revision marker does not match" in script
+    assert "neither an exact Git checkout nor bound" in script
     assert 'running_revision" != "$GEOINTEL_BUILD_SHA"' in script
     assert 'running_ai" != "true"' in script
     assert '"revision": revision' in script