build-web and build-appservice sat on a main-only when-anchor while
build-gateway used the next-capable one, so next-lane pushes produced
gateway sha images with no web/appservice counterpart — no sha-parity
image set existed for next-lane containerized deploys (measured: web and
appservice each had exactly one sha tag, the month-old last main build).
Fix: single shared image_build_when anchor for all three image steps;
web/appservice adopt the gateway-style branch guard (next = sha-only
destinations, tag refused; main adds :latest; anything else requires a
tag). The divergent second anchor is removed — two near-identical anchors
silently drifting apart is the defect class itself.
scripts/verify-release.test.mjs: 11/11 pass (SDLC-D-034 gate unchanged;
depends_on untouched, publish-next-npm serialization edge intact).
fred