fix: harden release artifact checks and fixture isolation

tests/release-safety.test.ts

@@ -34,14 +34,19 @@ describe('deployment rollout gate', () => {
   test('release check catches unsafe production inputs without printing values', () => {
     const errors = releaseSafetyErrors({
       mode: 'demo', releaseId: 'local', releaseEnvironment: 'production', dashboardImage: 'convex-dashboard:latest',
+      convexImage: 'convex-backend:latest', dockerfile: 'FROM oven/bun:latest',
       capabilityAllowlist: 'wallet_balance,unknown', trackedFiles: ['.env.example', 'secrets/app.pem'],
+      browserBundleFiles: ['build/client/app.js'],
     });
     expect(errors).toEqual(expect.arrayContaining([
       'APP_RELEASE_ID must be a non-placeholder immutable identifier for this release environment',
       'CONVEX_DASHBOARD_IMAGE must be digest-pinned for staging/production',
+      'CONVEX_IMAGE must be digest-pinned for staging/production',
+      'Dockerfile base images must be digest-pinned for staging/production',
       'APP_MODE=demo is not permitted for a staging/production release',
       'Unknown deployment capability: unknown',
       'secret-like file is tracked: secrets/app.pem',
+      'browser client artifacts contain managed secret names',
     ]));
   });
 });