feat(runtime): 정적 프런트엔드와 격리 빌더를 구성한다

Caddy가 불변 아티팩트를 직접 제공하고 runtime과 builder의 자원·비밀 경계를 분리한다.

Gateway active release ref를 재기동에 복원하고 production/development/smoke 모델 검증을 확장한다.

test/checkout-active-release.test.mjs

@@ -0,0 +1,62 @@
+import assert from 'node:assert/strict';
+import { execFileSync, spawnSync } from 'node:child_process';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import test from 'node:test';
+
+const script = path.resolve('runtime/checkout-active-release.sh');
+const roots = [];
+const git = (cwd, ...args) =>
+  execFileSync('git', args, {
+    cwd,
+    encoding: 'utf8',
+    env: {
+      ...process.env,
+      GIT_AUTHOR_NAME: 'Sammo Test',
+      GIT_AUTHOR_EMAIL: 'sammo-test@example.invalid',
+      GIT_COMMITTER_NAME: 'Sammo Test',
+      GIT_COMMITTER_EMAIL: 'sammo-test@example.invalid',
+    },
+  }).trim();
+
+const fixture = () => {
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), 'sammo-active-release-'));
+  roots.push(root);
+  git(root, 'init', '-b', 'main');
+  fs.writeFileSync(path.join(root, 'version.txt'), 'one\n');
+  git(root, 'add', 'version.txt');
+  git(root, 'commit', '-m', 'first');
+  const first = git(root, 'rev-parse', 'HEAD');
+  fs.writeFileSync(path.join(root, 'version.txt'), 'two\n');
+  git(root, 'commit', '-am', 'second');
+  const second = git(root, 'rev-parse', 'HEAD');
+  git(root, 'update-ref', 'refs/sammo/active-gateway', first);
+  return { root, first, second };
+};
+
+test.afterEach(() => {
+  for (const root of roots.splice(0)) fs.rmSync(root, { recursive: true, force: true });
+});
+
+test('checks out the persistent active release instead of the previous bootstrap HEAD', () => {
+  const { root, first, second } = fixture();
+  assert.equal(git(root, 'rev-parse', 'HEAD'), second);
+  execFileSync('/bin/sh', [script, root, 'refs/sammo/active-gateway']);
+  assert.equal(git(root, 'rev-parse', 'HEAD'), first);
+});
+
+test('rejects refs outside the managed release namespace', () => {
+  const { root } = fixture();
+  const result = spawnSync('/bin/sh', [script, root, 'refs/heads/main'], { encoding: 'utf8' });
+  assert.equal(result.status, 64);
+  assert.match(result.stderr, /refs\/sammo/u);
+});
+
+test('refuses to hide tracked bootstrap checkout changes', () => {
+  const { root, second } = fixture();
+  fs.writeFileSync(path.join(root, 'version.txt'), 'dirty\n');
+  const result = spawnSync('/bin/sh', [script, root, 'refs/sammo/active-gateway'], { encoding: 'utf8' });
+  assert.equal(result.status, 65);
+  assert.equal(git(root, 'rev-parse', 'HEAD'), second);
+});