The runtime image is distroless and has no git binary, so every sync
failed and bootapi silently served the stale embedded templates.
- fetch the branch tarball (<repo>/archive/<branch>.tar.gz) and extract
it into an in-memory FS; no checkout, no writable volume
- digest the extracted tree, not the archive bytes, so a recompressed
identical archive is not a change
- skip entries that would escape the tree
- log the source commit from Gitea's immutable Link header
unkin-agent