A provenance gate compares Git tags while the published release is built from a detached worktree tarball during a failover rehearsal

Source control identity and published artifact identity diverge even though both look plausible in isolation. Normal traffic masked the issue until the standby or alternate path became active under rehearsal conditions.