Merge origin/main into fix/gemini-cli-v1internal

apps/aether-gateway/src/tests/architecture/admin_system.rs

@@ -24,6 +24,42 @@ fn admin_system_build_version_contract_uses_explicit_local_build_arg() {
             "Dockerfile.app.local should pass explicit build version pattern {pattern}"
         );
     }
+
+    let deploy = read_workspace_file("deploy.sh");
+    for pattern in [
+        "detect_build_version()",
+        "git describe --tags --always --dirty",
+        "AETHER_BUILD_VERSION=\"${AETHER_BUILD_VERSION:-$(detect_build_version)}\"",
+        "--build-arg \"AETHER_BUILD_VERSION=$AETHER_BUILD_VERSION\"",
+        ">>> AETHER_BUILD_VERSION",
+    ] {
+        assert!(
+            deploy.contains(pattern),
+            "deploy.sh should pass deterministic local build version pattern {pattern}"
+        );
+    }
+
+    let vite_config = read_workspace_file("frontend/vite.config.ts");
+    for pattern in [
+        "process.env.AETHER_BUILD_VERSION",
+        "process.env.AETHER_VERSION",
+    ] {
+        assert!(
+            vite_config.contains(pattern),
+            "frontend/vite.config.ts should consume local build version pattern {pattern}"
+        );
+    }
+
+    let core_api = read_workspace_file("apps/aether-gateway/src/api/core.rs");
+    for pattern in [
+        "option_env!(\"AETHER_BUILD_VERSION\")",
+        "\"version\": current_gateway_version()",
+    ] {
+        assert!(
+            core_api.contains(pattern),
+            "api/core.rs should expose build version pattern {pattern}"
+        );
+    }
 }
 
 #[test]

apps/aether-gateway/src/tests/architecture/runtime_and_security.rs

@@ -371,7 +371,7 @@ fn scheduler_candidate_runtime_paths_depend_on_scheduler_core_and_state_trait()
         "candidate/mod.rs should not own the core selectable-candidate collector anymore"
     );
     assert!(
-        !candidate_mod.contains("auth_api_key_concurrency_limit_reached"),
+        !candidate_mod.contains("auth_api_key_concurrency_limit_reached("),
         "candidate/mod.rs should not own the core auth api key concurrency helper anymore"
     );
     assert!(
@@ -463,7 +463,7 @@ fn scheduler_candidate_runtime_paths_depend_on_scheduler_core_and_state_trait()
         "read_provider_key_rpm_states(",
         "candidate_is_selectable_with_runtime_state",
         "collect_selectable_candidates_from_keys",
-        "auth_api_key_concurrency_limit_reached",
+        "auth_api_key_concurrency_limit_reached(",
         "build_provider_concurrent_limit_map(",
         "reorder_candidates_by_scheduler_health",
     ] {
@@ -487,7 +487,7 @@ fn scheduler_candidate_runtime_paths_depend_on_scheduler_core_and_state_trait()
         "candidate/runtime.rs should keep affinity out of runtime eligibility checks"
     );
     assert!(
-        runtime.contains("auth_api_key_concurrency_limit_reached"),
+        runtime.contains("auth_api_key_concurrency_limit_reached("),
         "candidate/runtime.rs should depend on core auth api key concurrency helper"
     );
     assert!(