Verify deployed artifacts before choosing a minimal-change base

A reported release SHA is a label, not an attestation of the running artifact. Before a narrow gateway rollout, compare the deployed routing/configuration and application files against the proposed base; an older labeled base can accidentally undo already-live behavior. Keep code identity, configured policy and observed caller behavior as separate checks. A byte-level discrepancy is a reason to reconcile provenance, not permission to change an access boundary: seek explicit approval where the required preservation patch changes permissions relative to the branch. Generalized from read-only runtime-file hash comparison during Sesh integration (observed 2026-09-08 UTC; e3-solutions/e3-mcp PR #40, COR-4025). Supports keeping implementation, deployment and behavior-verification evidence distinct. This is a method, not a statement of current service configuration or health.