redirector: commit stamp + shared build-identity verifier that REFUSES

The binary records only the commit it was built from -- no dirty-tree flag.
Cargo will not re-run a build script because another crate's source changed, so
a compiled-in 'clean' claim can be stale and is not a safeguard; that was
verified on the Blaze host.

scripts/verify-build-identity.sh establishes both facts at LAUNCH, where they
cannot go stale: the stamped commit equals HEAD, and the migration crates are
clean. It REFUSES rather than warns, because for a migration gate a warning on
stderr is something to scroll past.

--identity prints the stamp without valid configuration. The launcher must be
able to establish which commit a binary came from BEFORE deciding whether to
run it; requiring a correct environment first would invert the check.

redirector.sh mirrors sidecar.sh: refuses to start with an orphan present or
the port busy, matches the resolved executable rather than the command line
(pgrep -f matches any shell mentioning the name), and stop PROVES the process
is gone and the port free.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

scripts/verify-build-identity.sh

@@ -0,0 +1,46 @@
+#!/usr/bin/env bash
+# Is this binary trustworthy as gate evidence?
+#
+#   verify-build-identity.sh <binary-commit>
+#
+# Two independent facts, both established HERE at launch rather than trusted
+# from inside the binary:
+#
+#   1. the stamped commit equals the checkout's real HEAD
+#   2. the migration crates have no uncommitted changes
+#
+# A compiled-in cleanliness flag cannot do this: cargo will not re-run a build
+# script because another crate's source changed, so it can read "clean" for a
+# binary built from edited sources. Verified on the Blaze host.
+#
+# REFUSES (exit non-zero) rather than warning. For a migration gate a warning on
+# stderr is not a safeguard — it is something to scroll past.
+set -uo pipefail
+cd "$(dirname "$(readlink -f "$0")")/.."
+
+STAMPED="${1:-}"
+[[ -n "$STAMPED" ]] || { echo "usage: verify-build-identity.sh <binary-commit>" >&2; exit 2; }
+
+CRATES=(openfut-protocol-blaze openfut-adapter-fifa17 openfut-host-config
+        openfut-blaze-host openfut-redirector-host)
+
+rc=0
+HEAD_NOW="$(git rev-parse --short=7 HEAD 2>/dev/null || echo unknown)"
+
+if [[ "$STAMPED" != "$HEAD_NOW" ]]; then
+  echo "REFUSING: binary was built from $STAMPED but HEAD is $HEAD_NOW" >&2
+  echo "  Rebuild before treating this run as evidence." >&2
+  rc=1
+fi
+
+DIRT="$(git status --porcelain --untracked-files=no -- "${CRATES[@]}" 2>/dev/null)"
+if [[ -n "$DIRT" ]]; then
+  echo "REFUSING: migration crates have uncommitted changes:" >&2
+  sed 's/^/  /' <<<"$DIRT" >&2
+  rc=1
+fi
+
+if [[ $rc -eq 0 ]]; then
+  echo "build identity OK: commit $STAMPED == HEAD, migration crates clean"
+fi
+exit $rc