feat(cli): enforce stamped-copy and deployed-instance boundaries (#1873)

scripts/stack-copy.sh

@@ -81,6 +81,7 @@ copy_tree() {
  git -C "$1" archive --format=tar "$full" -- "${COPY_PATHS[@]}" | tar -xf - -C "$tmp" || die "git archive failed; no copy written"
  [ -f "$tmp/package.json" ] && [ -f "$tmp/package-lock.json" ] || die 'package.json or package-lock.json missing in temp copy; npm ci not run'
  (cd "$tmp" && npm ci --no-audit --no-fund) >&2 || die 'npm ci failed; no copy written'
+ printf '{"commit":"%s"}\n' "$full" > "$tmp/.stack-build.json"
  find "$tmp" -type f -exec chmod a-w {} +
  find "$tmp" -type d -exec chmod 0555 {} +
  if ! mv -T "$tmp" "$target" 2>/dev/null; then