fix(oven): freeze native release metadata

fedac/native/scripts/upload-release.sh

···
   GIT_CWD="$GIT_ROOT"
   GIT_NATIVE_PATHS=(fedac/native fedac/nixos)
 fi
-GIT_HASH=$(git -C "$GIT_CWD" rev-parse --short HEAD 2>/dev/null || echo "unknown")
+GIT_HASH="${AC_GIT_HASH:-$(git -C "$GIT_CWD" rev-parse --short HEAD 2>/dev/null || echo "unknown")}"
 CONFLICT_FILES=$(git -C "$GIT_CWD" diff --name-only --diff-filter=U -- "${GIT_NATIVE_PATHS[@]}" 2>/dev/null || true)
 if [ -n "$CONFLICT_FILES" ]; then
   echo "Error: refusing upload with unresolved merge conflicts:" >&2
···
 if [ "$DIRTY_TRACKED" -eq 1 ]; then
   GIT_HASH="${GIT_HASH}-dirty"
 fi
-BUILD_TS=$(date -u '+%Y-%m-%dT%H:%M')
+BUILD_TS="${AC_BUILD_TS:-$(date -u '+%Y-%m-%dT%H:%M')}"
 # Format must match AC_GIT_HASH "-" AC_BUILD_TS in js-bindings.c / Makefile
 VERSION="${GIT_HASH}-${BUILD_TS}"
 
···
   || echo '{"releases":[]}' > "$RELEASES_JSON"
 
 # Append new entry (keep last 50)
-COMMIT_MSG=$(git -C "$GIT_CWD" log -1 --format="%s" 2>/dev/null || echo "")
+COMMIT_MSG="${AC_COMMIT_MSG:-$(git -C "$GIT_CWD" log -1 --format="%s" 2>/dev/null || echo "")}"
 BUILD_HANDLE="${AC_HANDLE:-}"
 
 python3 - "$RELEASES_JSON" "$FULL_VERSION" "$SHA256" "$SIZE" "$GIT_HASH" "$BUILD_TS" "$BUILD_NAME" "$CHANNEL_PREFIX" "$COMMIT_MSG" "$BUILD_HANDLE" <<'PYEOF'
···
 
 # Record build in MongoDB
 if command -v node &>/dev/null; then
-  echo "{\"name\":\"$BUILD_NAME\",\"buildNum\":$BUILD_NUM,\"version\":\"$FULL_VERSION\",\"sha256\":\"$SHA256\",\"size\":$SIZE,\"git_hash\":\"$GIT_HASH\",\"build_ts\":\"$BUILD_TS\",\"url\":\"${BASE_URL}/os/native-notepat-latest.vmlinuz\"}" \
+  BUILD_NUM_JSON="${BUILD_NUM:-null}"
+  echo "{\"name\":\"$BUILD_NAME\",\"buildNum\":$BUILD_NUM_JSON,\"version\":\"$FULL_VERSION\",\"sha256\":\"$SHA256\",\"size\":$SIZE,\"git_hash\":\"$GIT_HASH\",\"build_ts\":\"$BUILD_TS\",\"url\":\"${BASE_URL}/os/native-notepat-latest.vmlinuz\"}" \
     | node "$SCRIPT_DIR/track-build.mjs" record 2>&1 || true
 fi
 

oven/native-builder.mjs

···
     }
 
     const buildName = await runSync("bash", ["scripts/build-name.sh"], NATIVE_DIR) || `oven-${job.ref.slice(0, 7)}`;
+    const buildGitHash = await runSync("git", ["rev-parse", "--short", "HEAD"], repoDir) || job.ref.slice(0, 9);
+    const buildTs = new Date().toISOString().slice(0, 16);
     const commitMsg = await runSync("git", ["log", "-1", "--format=%s", job.ref], repoDir) || "";
     job.buildName = buildName;
+    job.buildGitHash = buildGitHash;
+    job.buildTs = buildTs;
     job.commitMsg = commitMsg;
     const vmlinuzOut = `/tmp/oven-vmlinuz-${job.id}`;
 
···
       DO_SPACES_KEY: process.env.DO_SPACES_KEY || process.env.ART_SPACES_KEY || "",
       DO_SPACES_SECRET: process.env.DO_SPACES_SECRET || process.env.ART_SPACES_SECRET || "",
       AC_BUILD_NAME: buildName,
+      AC_GIT_HASH: buildGitHash,
+      AC_BUILD_TS: buildTs,
+      AC_COMMIT_MSG: commitMsg,
     };
 
     // ── C variant ──
···
       addLogLine(job, "stdout", "Phase 2: Compiling C kernel in Docker...");
       const cidFile = `/tmp/oven-cid-${job.id}`;
       await runPhase(job, "build", "bash", ["-c", [
-        `CID=$(docker create -e AC_BUILD_NAME=${buildName} -v ac-os-ccache:/ccache ac-os-builder)`,
+        `CID=$(docker create -e AC_BUILD_NAME=${buildName} -e AC_GIT_HASH=${buildGitHash} -e AC_BUILD_TS=${buildTs} -v ac-os-ccache:/ccache ac-os-builder)`,
         `echo $CID > ${cidFile}`,
         `docker start -a $CID`,
       ].join(" && ")], repoDir);
···
       const clVmlinuzOut = `/tmp/oven-cl-vmlinuz-${job.id}`;
 
       await runPhase(job, "cl-build", "bash", ["-c", [
-        `CID=$(docker create -e AC_BUILD_NAME=${buildName} -e AC_BUILD_VARIANT=cl -e AC_BUILD_LISP=1 ac-os-builder)`,
+        `CID=$(docker create -e AC_BUILD_NAME=${buildName} -e AC_GIT_HASH=${buildGitHash} -e AC_BUILD_TS=${buildTs} -e AC_BUILD_VARIANT=cl -e AC_BUILD_LISP=1 ac-os-builder)`,
         `echo $CID > ${clCidFile}`,
         `docker start -a $CID`,
       ].join(" && ")], repoDir);