build: the Doorpost read before the image is built

Tablet 54 (2026-10-15): two spec edits in @spec_files shipped without
moving @expected_hash; the pod logged DOORPOST_DRIFT_AT_STARTUP,
readiness answered 503, and the gate — with every Claude Code session
behind it — went dark. The Doorpost test catches this only when the
suite runs on the exact commit that gets built, and the build script
never ran it.

scripts/doorpost_check.py computes the Doorpost identity the way the
module does (sha256 per spec file in listed order, "path\thash" joined
by newline, sha256 of that) with no Elixir, against the working tree
the image is copied from (default) or a git revision (--rev). On a
mismatch it exits 1 and names each file changed since --base
(origin/main). scripts/build_and_push.sh runs it before anything else
and refuses to build; DOORPOST_SKIP=1 is the written-down exception.

Proven: working tree and cb18f719 match their pins; 347f83cf (the
tablet 54 commit) reports DRIFT naming specs/bikoret_tamid.md and
specs/bishearecha.md; a blank line appended to specs/lo_tosif.md makes
both the check and the build script exit 1. KOHEN.md "Rolling out"
carries the procedure.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

scripts/build_and_push.sh

@@ -53,6 +53,16 @@ if [[ ! -d "deploy/docker" || ! -d "l1/torah" ]]; then
 fi
 
 # Sanity: docker buildx
+# The Doorpost, read before the build: the spec files the image will carry
+# must hash to the pin baked into VavPipeline.Doorpost, or the pod drifts
+# at startup, readiness answers 503, and the gate goes dark (tablet 54,
+# 2026-10-15). scripts/doorpost_check.py computes the same hash the same
+# way and names the drifted files. DOORPOST_SKIP=1 only for a deliberate,
+# documented exception — never to ship a drift.
+if [[ "${DOORPOST_SKIP:-0}" != "1" ]]; then
+  python3 -I scripts/doorpost_check.py || exit 1
+fi
+
 if ! docker buildx version >/dev/null 2>&1; then
   echo "ERROR: docker buildx not available — install Docker Desktop or buildx plugin" >&2
   exit 1