fix(deploy): exclude generated credentials from image context

[Pigbibi]

Scope

Build from git archive HEAD rather than the entire runner workspace. The Google auth action creates an untracked credentials file after checkout; it must not enter the image via COPY . .

Verification

The existing CI shell gate now executes the actual build command against a synthetic checkout containing an untracked synthetic auth file.

• Original workspace build: actual RED (exit 1).
• Tracked-source archive build: GREEN; only the two tracked synthetic source files reached the Docker stub.
• Existing no-traffic shell gate and bash syntax: PASS.
• Offline admission/readback tests: 13 passed.
• git diff --check: PASS.

Exactly two files changed. No credential values were inspected, logged, downloaded, or placed in fixtures. No traffic shift, IAM, Scheduler, env sync, broker action, deletion, or additional deployment is part of this PR. The staged revision remains at zero traffic; a fresh deployment requires a separate bounded validation after this fix and CI.