fix(ops): support clean targeted Gateway rebuilds

[Pigbibi]

Summary

• add read-only diagnostics for the remote source run.sh alongside the built image copy
• add an opt-in rebuild_without_cache input for full manual deploys
• keep normal push/scheduled/manual build behavior unchanged unless explicitly selected

Evidence

• U***8560 remote source is 6764 bytes with the expected hash, while the cached image layer contains a zero-byte run.sh
• the prior targeted full rebuild reused the bad COPY layer (#8 CACHED)

Validation

• bash tests/test_install_2fa_bot_watcher.sh
• bash tests/test_wait_for_ib_gateway_ready.sh
• bash tests/test_workflow_shared_config.sh
• bash tests/test_docker_compose_ports.sh
• bash tests/test_gateway_recovery_scripts.sh
• bash tests/test_run_override_api_config.sh
• actionlint .github/workflows/*.yml
• git diff --check

[github-actions]

🤖 Codex PR Review

✅ Merge allowed: blocking findings were cleared by independent Codex arbitration

⚖️ Codex Review Arbitration

✅ clear: The prior high-severity logic bug in .github/workflows/main.yml is demonstrably fixed in the current cumulative diff. The deploy job now exports WORKFLOW_DISPATCH_REBUILD_WITHOUT_CACHE: ${{ github.event.inputs.rebuild_without_cache }} and the rebuild branch tests the expanded shell variable as if [ "${WORKFLOW_DISPATCH_REBUILD_WITHOUT_CACHE:-false}" = 'true' ]; then, which allows parameter expansion and correctly selects sudo docker compose build --no-cache "${compose_service_name}" when the manual input is true. This directly addresses the prior failure mode where single-quoting the expansion prevented any effect. The updated shell test in tests/test_workflow_shared_config.sh also asserts the corrected condition and no-cache build command, with no conflicting source-of-truth evidence in the provided diff.

---

Review by Codex PR Review bot • PR