fix: distinguish static artifact basis from deployment head

#7

Upgrades the static source-attestation contract to v2. current_hf_revision is explicitly null because a committed static file cannot self-embed its resulting commit; the immutable measured pre-attestation revision moves to artifact_basis. This prevents consumers from treating the artifact basis as the live deployment SHA. Local verification: 1 contract test passed.

Merged after immutable refs/pr verification: intended minimal diff only, focused regression test passed from the remote PR ref, no conflicts, and no protected independent-review gate was bypassed.

betterwithage changed pull request status to merged

Sign up or log in to comment