Add agentex.lib.utils.build_provenance — the single producer of source
identity for agent builds (git coordinates + a deterministic content hash
of the build context). prepare_cloud_build_context now writes
build-info.json into the staged context (populates runtime
registration_metadata with no server change) and exposes provenance on
CloudBuildContext so the upload can send source_* fields. Archive member
order is now deterministic via a sorted enumeration shared with the hash.

The hash is computed only when there is no clean commit to identify the
build (dirty tree or non-git context). First of three surfaces for
AGX1-418 (Phase 1, client-attested); the SGP build-record columns and the
sgpctl/Gitea uploaders follow.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Address Greptile review on the build-provenance capture util:

- Always compute working_tree_hash (drop the "skip on clean commit"
  path). A `git status` clean tree can still contain .gitignore'd-but-not-
  .dockerignore'd files the commit can't reproduce; an always-present
  content hash identifies the exact shipped bytes and closes that gap.
- Guard the hash (_safe_working_tree_hash) so a permission error or
  filesystem race degrades to None instead of aborting the build — the
  module contract is that capture never raises into a build.
- Record dirtiness as a first-class `dirty` flag (surfaced as `source_dirty`
  / `dirty`) rather than overloading hash-presence, matching Go's
  vcs.modified and Nix's dirtyRev. None outside a git work tree.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Greptile (T-Rex repro) showed build-info.json was written to the archive
root, which the templates' Dockerfiles don't COPY and the runtime
locate_build_info_path() doesn't read — so it never reached the image and
the registration_metadata sink stayed empty.

Beyond the placement bug, the sink is redundant: AgentexCloudDeploy.build_id
is an FK to AgentexCloudBuild, so a deployment's source provenance derives
from the build record (the source_* columns this work adds, Surface C) over
that join — the same Build->Deploy edge lineage already traverses. No need
to denormalize provenance onto registration_metadata/DeploymentHistory
(which has had no producer since its read path landed 2025-09, so its git
fields have never been populated).

#454 now ships only the shared capture util (agentex.lib.build_provenance)
plus a deterministic build-archive ordering. Provenance is delivered via the
build-record sink; the runtime sink can be revived (correctly placed) if a
real consumer for deployment-history provenance ever appears.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

#460)

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

…t in workflow templates

…ty trace (#465)

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

One add/add conflict in obs_ids.py, which both branches created independently.
Took next's side on both hunks:

- `from typing import Dict, Tuple, Optional` — next's length-sorted order is
  what ruff's isort config wants here. This branch's alphabetical order was the
  I001 that had been failing the lint job, so resolving the conflict fixes it.
- `from ddtrace.trace import tracer` — the path ddtrace exposes now, and the
  only form used elsewhere in the tree.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>