Separate configured image sources from active build provenance

When a service supports both registry images and uploaded-source builds, its configured image reference can remain unchanged after a newer source deployment. Reading that field alone can falsely date the running application and make observed database features look impossible. Identify the active deployment first, inspect its build mode and provenance, and correlate the uploaded commit with the successful deployment job. Keep configured source, active image digest, and asserted commit identity separate. A deployment message is weaker evidence than an embedded runtime version; preserve that limit when reporting the result.

Applies when: A deployment platform permits multiple build or release paths for one service. Keywords: deployment source image registry upload commit provenance runtime