feat(runtime): 정적 프런트엔드와 격리 빌더를 구성한다

Caddy가 불변 아티팩트를 직접 제공하고 runtime과 builder의 자원·비밀 경계를 분리한다.

Gateway active release ref를 재기동에 복원하고 production/development/smoke 모델 검증을 확장한다.

runtime/checkout-active-release.sh

@@ -0,0 +1,31 @@
+#!/bin/sh
+set -eu
+
+core_root=${1:?usage: checkout-active-release.sh CORE_ROOT RELEASE_REF}
+active_release_ref=${2:-}
+
+if [ -z "$active_release_ref" ]; then
+  exit 0
+fi
+case "$active_release_ref" in
+  refs/sammo/*) ;;
+  *)
+    echo 'GATEWAY_ACTIVE_RELEASE_GIT_REF must be below refs/sammo/' >&2
+    exit 64
+    ;;
+esac
+if ! git check-ref-format "$active_release_ref" >/dev/null 2>&1; then
+  echo 'GATEWAY_ACTIVE_RELEASE_GIT_REF is not a valid Git ref' >&2
+  exit 64
+fi
+if ! git -C "$core_root" show-ref --verify --quiet "$active_release_ref"; then
+  exit 0
+fi
+if ! git -C "$core_root" diff --quiet || ! git -C "$core_root" diff --cached --quiet; then
+  echo 'Core bootstrap checkout has tracked changes; refusing to switch the active release ref' >&2
+  exit 65
+fi
+
+active_release_sha=$(git -C "$core_root" rev-parse --verify "${active_release_ref}^{commit}")
+git -C "$core_root" checkout --quiet --detach "$active_release_sha"
+echo "Using persistent Gateway release $active_release_sha for runtime bootstrap."