feat(runtime): 정적 프런트엔드와 격리 빌더를 구성한다

Caddy가 불변 아티팩트를 직접 제공하고 runtime과 builder의 자원·비밀 경계를 분리한다.

Gateway active release ref를 재기동에 복원하고 production/development/smoke 모델 검증을 확장한다.

runtime/entrypoint.sh

@@ -69,6 +69,7 @@ case "${CORE_SOURCE_MODE:-clone}" in
 esac
 
 git config --global --add safe.directory "$core_root"
+/opt/sammo/checkout-active-release.sh "$core_root" "${GATEWAY_ACTIVE_RELEASE_GIT_REF:-}"
 export GATEWAY_WORKSPACE_ROOT="$core_root"
 export RELEASE_CONTROLLER_WORKSPACE_ROOT="$core_root"
 
@@ -85,7 +86,6 @@ export GATEWAY_DATABASE_URL="$DATABASE_URL"
 export REDIS_URL="$(node -e 'const u=new URL("redis://localhost/0");u.password=process.env.REDIS_PASSWORD;u.hostname=process.env.REDIS_HOST||"redis";u.port=process.env.REDIS_PORT||"6379";process.stdout.write(u.href)')"
 
 cd "$core_root"
-pnpm install --frozen-lockfile
 
 if [ "${RUNTIME_MODE:-production}" = development ]; then
   pnpm --filter @sammo-ts/infra prisma:generate
@@ -96,16 +96,16 @@ if [ "${RUNTIME_MODE:-production}" = development ]; then
   exec sleep infinity
 fi
 
-pnpm --filter @sammo-ts/common build
-pnpm --filter @sammo-ts/infra prisma:generate
-pnpm --filter @sammo-ts/infra build
-pnpm --filter @sammo-ts/logic build
-pnpm --filter @sammo-ts/game-engine build
-pnpm --filter @sammo-ts/gateway-api build
-pnpm --filter @sammo-ts/gateway-frontend build
-pnpm --filter @sammo-ts/release-controller build
+node /opt/sammo/release-builder-client.mjs
 pnpm --filter @sammo-ts/infra prisma:migrate:deploy:gateway
 
+core_commit_sha=$(git rev-parse HEAD)
+node tools/build-scripts/publish-frontend-artifact.mjs \
+  --artifact-root "${FRONTEND_ARTIFACT_ROOT:-/srv/frontend-artifacts}" \
+  --frontend-key gateway \
+  --source-root "$core_root/app/gateway-frontend/dist" \
+  --commit-sha "$core_commit_sha"
+
 GATEWAY_ROLE=api node app/gateway-api/dist/index.js &
 bootstrap_pid=$!
 cleanup_bootstrap() {