build: the Doorpost read before the image is built

Tablet 54 (2026-10-15): two spec edits in @spec_files shipped without
moving @expected_hash; the pod logged DOORPOST_DRIFT_AT_STARTUP,
readiness answered 503, and the gate — with every Claude Code session
behind it — went dark. The Doorpost test catches this only when the
suite runs on the exact commit that gets built, and the build script
never ran it.

scripts/doorpost_check.py computes the Doorpost identity the way the
module does (sha256 per spec file in listed order, "path\thash" joined
by newline, sha256 of that) with no Elixir, against the working tree
the image is copied from (default) or a git revision (--rev). On a
mismatch it exits 1 and names each file changed since --base
(origin/main). scripts/build_and_push.sh runs it before anything else
and refuses to build; DOORPOST_SKIP=1 is the written-down exception.

Proven: working tree and cb18f719 match their pins; 347f83cf (the
tablet 54 commit) reports DRIFT naming specs/bikoret_tamid.md and
specs/bishearecha.md; a blank line appended to specs/lo_tosif.md makes
both the check and the build script exit 1. KOHEN.md "Rolling out"
carries the procedure.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

KOHEN.md

@@ -566,6 +566,26 @@ is (Day 4). `scripts/upstream-key-set` stores a caller's model key for
 the gate scenario without echoing it (`~/.config/bikoret/upstream_keys`,
 0600) — run it from a real terminal, not through a non-interactive runner.
 
+**Before the image is built — the Doorpost read on the workbench.**
+`VavPipeline.Doorpost` bakes a hash over the category-grade spec files
+(`@spec_files` in `vav_pipeline/lib/vav_pipeline/doorpost.ex`); a pod
+whose files do not match logs `DOORPOST_DRIFT_AT_STARTUP`, answers 503
+on readiness, and takes the gate dark (tablet 54: two spec edits shipped
+without the pin). `scripts/build_and_push.sh` now runs
+`scripts/doorpost_check.py` first and refuses to build on drift, naming
+the files that changed since `origin/main`. Hand builds should do the
+same:
+
+```bash
+python3 -I scripts/doorpost_check.py            # the working tree, as the image is built from
+python3 -I scripts/doorpost_check.py --rev HEAD # a commit
+python3 -I scripts/doorpost_check.py --print    # the hash the pin should be
+```
+
+A spec change and its pin move belong in ONE commit, with
+`mix test test/doorpost_test.exs` run on it. `DOORPOST_SKIP=1` exists
+for a deliberate, written-down exception; it is never the way to ship.
+
 ### Standing at the gate — *Bishe'arecha*
 
 A caller can put Bikoret between themselves and a model instead of