fix: verify fetched source revisions from lock

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a058f3-8ba0-7692-a042-9a870fc3d663

tools/build_site.py

@@ -45,6 +45,30 @@ def _source_revision(repo: Path, source: Path) -> str:
                 f"{revision_env} must be a clean 40-hex Git commit, got {supplied_revision!r}"
             )
         return supplied_revision
+    source_root = os.environ.get("POLICY_NEXUS_SOURCE_ROOT", "")
+    if source_root:
+        root = Path(source_root).resolve()
+        try:
+            repo.relative_to(root)
+        except ValueError:
+            pass
+        else:
+            lock_path = root / "source-lock.json"
+            try:
+                lock = json.loads(lock_path.read_text(encoding="utf-8"))
+                locked_revision = lock["repositories"][repo.name]["revision"]
+            except (KeyError, OSError, TypeError, json.JSONDecodeError) as exc:
+                raise ValueError(
+                    f"{repo.name}: source revision is missing from {lock_path}"
+                ) from exc
+            if not isinstance(locked_revision, str) or not CLEAN_GIT_REVISION.fullmatch(
+                locked_revision
+            ):
+                raise ValueError(
+                    f"{repo.name}: locked source revision must be a clean 40-hex Git commit, "
+                    f"got {locked_revision!r}"
+                )
+            return locked_revision
     try:
         head = subprocess.run(
             ["git", "-C", str(repo), "rev-parse", "HEAD"],