Fix release version credential fallback (#258)

## Summary
- fall back to the existing scoped `RELEASE_MANAGER_GATE_TOKEN` when
`SERVER_UPDATE_TOKEN` is absent
- record the exact frontend SHA through the release-gate endpoint, then
independently read it back
- preserve the legacy dedicated-token path when it is configured
- carry the scoped credential and exact run-attempt build ID through
normal releases, rollback recovery, and restore-on-failure

## Dependency
Depends on backend PR copenhagentruckwash/api#342 being merged and
deployed before this PR is merged.

## Verification
- focused release-gate updater test: 1 passed
- direct exact-SHA update/readback execution passed
- ESLint passed for changed JavaScript/tests
- Prettier passed for both workflows and changed JavaScript/tests
- Node syntax and `git diff --check` passed

The existing broader cPanel release test is also updated; the local
cached dependency set cannot collect that file because `jszip` is
absent, so protected CI remains the full-suite authority.

.github/workflows/release-recovery.yml

@@ -107,6 +107,7 @@ jobs:
             && proof.releaseManagerGate === "passed"
             && proof.serverVersionUpdated === true
             && proof.serverVersionReadBack === "passed"
+            && /^[1-9][0-9]*-[1-9][0-9]*$/.test(String(proof.buildId || ""))
             && typeof proof.activeTarget === "string"
             && proof.activeTarget.startsWith(expectedPrefix)
             && proof.activeTarget.endsWith("/dist");
@@ -115,6 +116,7 @@ jobs:
             throw new Error("Rollback target does not match the verified release proof.");
           }
           appendFileSync(process.env.GITHUB_OUTPUT, `verified_target=${proof.activeTarget}\n`);
+          appendFileSync(process.env.GITHUB_OUTPUT, `build_id=${proof.buildId}\n`);
           NODE
 
       - name: Capture current immutable target
@@ -135,7 +137,10 @@ jobs:
           if (!/^[a-f0-9]{40}$/.test(sha) || !/^[A-Za-z0-9._-]{1,180}$/.test(build)) {
             throw new Error("Active manifest has invalid release identity.");
           }
-          appendFileSync(process.env.GITHUB_OUTPUT, `previous_sha=${sha}\nprevious_target=releases/${sha}-${build}/dist\n`);
+          if (!/^[1-9][0-9]*-[1-9][0-9]*$/.test(build)) {
+            throw new Error("Active manifest build id is not a release run identity.");
+          }
+          appendFileSync(process.env.GITHUB_OUTPUT, `previous_sha=${sha}\nprevious_build_id=${build}\nprevious_target=releases/${sha}-${build}/dist\n`);
           NODE
 
       - name: Setup Node.js
@@ -224,7 +229,9 @@ jobs:
         run: npm run release:update-server-version
         env:
           SERVER_UPDATE_TOKEN: ${{ secrets.SERVER_UPDATE_TOKEN }}
+          RELEASE_MANAGER_GATE_TOKEN: ${{ secrets.RELEASE_MANAGER_GATE_TOKEN }}
           RELEASE_VERSION: ${{ inputs.source_sha }}
+          RELEASE_BUILD_ID: ${{ steps.authorize.outputs.build_id }}
           RELEASE_VERSION_UPDATE_REQUIRED: "true"
 
       - name: Publish recovery audit
@@ -264,6 +271,7 @@ jobs:
           NODE_OPTIONS: --use-system-ca
           RELEASE_ROLLBACK_TARGET: ${{ steps.current.outputs.previous_target }}
           RELEASE_VERSION: ${{ steps.current.outputs.previous_sha }}
+          RELEASE_BUILD_ID: ${{ steps.current.outputs.previous_build_id }}
           RELEASE_VERSION_UPDATE_REQUIRED: "true"
           PRODUCTION_FTP_HOST: ${{ secrets.PRODUCTION_FTP_HOST }}
           PRODUCTION_FTP_USER: ${{ secrets.PRODUCTION_FTP_USER }}
@@ -272,3 +280,4 @@ jobs:
           PRODUCTION_ACTIVATION_KEY: ${{ secrets.PRODUCTION_ACTIVATION_KEY }}
           PRODUCTION_FRONTEND_URL: ${{ vars.PRODUCTION_FRONTEND_URL || 'https://truckwash.io' }}
           SERVER_UPDATE_TOKEN: ${{ secrets.SERVER_UPDATE_TOKEN }}
+          RELEASE_MANAGER_GATE_TOKEN: ${{ secrets.RELEASE_MANAGER_GATE_TOKEN }}

.github/workflows/release.yml

@@ -344,6 +344,7 @@ jobs:
         run: npm run release:update-server-version
         env:
           SERVER_UPDATE_TOKEN: ${{ secrets.SERVER_UPDATE_TOKEN }}
+          RELEASE_MANAGER_GATE_TOKEN: ${{ secrets.RELEASE_MANAGER_GATE_TOKEN }}
           RELEASE_VERSION: ${{ github.event.workflow_run.head_sha }}
           RELEASE_VERSION_UPDATE_REQUIRED: "true"
 
@@ -425,8 +426,9 @@ jobs:
         run: |
           set -euo pipefail
           node scripts/release/deploy-cpanel.mjs --rollback
-          [[ "$RELEASE_ROLLBACK_TARGET" =~ ^releases/([a-f0-9]{40})-[A-Za-z0-9._-]+/dist$ ]]
+          [[ "$RELEASE_ROLLBACK_TARGET" =~ ^releases/([a-f0-9]{40})-([1-9][0-9]*-[1-9][0-9]*)/dist$ ]]
           export RELEASE_VERSION="${BASH_REMATCH[1]}"
+          export RELEASE_BUILD_ID="${BASH_REMATCH[2]}"
           npm run release:update-server-version
         env:
           NODE_OPTIONS: --use-system-ca
@@ -438,6 +440,7 @@ jobs:
           PRODUCTION_ACTIVATION_KEY: ${{ secrets.PRODUCTION_ACTIVATION_KEY }}
           PRODUCTION_FRONTEND_URL: ${{ vars.PRODUCTION_FRONTEND_URL || 'https://truckwash.io' }}
           SERVER_UPDATE_TOKEN: ${{ secrets.SERVER_UPDATE_TOKEN }}
+          RELEASE_MANAGER_GATE_TOKEN: ${{ secrets.RELEASE_MANAGER_GATE_TOKEN }}
           RELEASE_VERSION_UPDATE_REQUIRED: "true"
 
       - name: Upload Playwright report