fix(deploy): avoid source guard self-match

www/tools/deploy.mjs

@@ -69,7 +69,9 @@ export async function releaseManifest(dist, sourceCommit) {
       }
       publicPath(child);
       const bytes = await fs.readFile(path.join(dist, child));
-      if (bytes.includes(Buffer.from('PRIVATE KEY-----'))) fail(`Private-key material in artifact: ${child}`);
+      // Build the sentinel in memory so this guardrail can itself be included in
+      // the server-validated source snapshot without looking like a PEM body.
+      if (bytes.includes(Buffer.from(['PRIVATE', ' KEY-----'].join('')))) fail(`Private-key material in artifact: ${child}`);
       files[child] = { sha256: sha256(bytes), size: bytes.length };
     }
   }