feat(cli): enforce stamped-copy and deployed-instance boundaries (#1873)

scripts/case2-install.sh

@@ -203,6 +203,9 @@ if [ ! -e "$CONFIG_DIR" ]; then
 fi
 out="$("$REPO/scripts/bootstrap.sh" 2>&1)" || refuse "bootstrap: $(printf '%s' "$out" | tail -n 1)"
 say "config $CONFIG"
+# Case 1 and Case 2 share this installer. Deployment identity is instance-scoped,
+# never a switch that can be silently removed to enable the local dev owner.
+out="$(cd "$REPO" && node --input-type=module -e 'import { readFileSync } from "node:fs"; import { writeDeployment } from "./packages/cli/src/deployment.mjs"; writeDeployment(JSON.parse(readFileSync(process.argv[1], "utf8")));' "$CONFIG" 2>&1)" || refuse "deployment: $(printf '%s' "$out" | tail -n 1)"
 
 # 3. The stack copy row 195's units run from.
 out="$("$STACK_COPY" copy "$COMMIT" --copies "$COPIES" 2>&1)" || refuse "stack-copy: $(printf '%s' "$out" | tail -n 1)"

scripts/stack-copy.sh

@@ -81,6 +81,7 @@ copy_tree() {
  git -C "$1" archive --format=tar "$full" -- "${COPY_PATHS[@]}" | tar -xf - -C "$tmp" || die "git archive failed; no copy written"
  [ -f "$tmp/package.json" ] && [ -f "$tmp/package-lock.json" ] || die 'package.json or package-lock.json missing in temp copy; npm ci not run'
  (cd "$tmp" && npm ci --no-audit --no-fund) >&2 || die 'npm ci failed; no copy written'
+ printf '{"commit":"%s"}\n' "$full" > "$tmp/.stack-build.json"
  find "$tmp" -type f -exec chmod a-w {} +
  find "$tmp" -type d -exec chmod 0555 {} +
  if ! mv -T "$tmp" "$target" 2>/dev/null; then