Tier-0 regression: source binding missing on fresh attested deploys (since PR #69)

[amiller]

The Tier-0 platform-journey gate (oauth3-apps/harness/tier0-journeys.sh, cron every 30min on zed) flipped FAIL at 2026-07-04T17:30:13Z, first failing run after PR #69 (RFC 0029 Half A) merged to staging at 16:50Z touching proxy/deploy.py, proxy/evidence.py, proxy/projects.py, verify/facts.py.

Failing assertion (journey 3, fetch-attestation on a fresh source-backed deploy):

FAIL  tier0-att-NNNN: app.source.tree_hash absent — SOURCE BINDING MISSING

Repro on zed: bash ~/projects/oauth3-apps/harness/tier0-journeys.sh (deploys a throwaway from this repo's staging branch via POST /_api/projects with source+ref, promotes, asserts the evidence bundle). The same journey PASSed all day up to at least 14:00Z: quote and audit still present, only app.source/tree_hash vanished from the verification bundle.

Fix the evidence bundle so source binding survives, or revert the offending part of #69 on staging. Gate must return PASS: GATE: PASS (all 3 Tier-0 journeys verified).

[amiller]

Broader than first reported: the 17:30Z gate run also shows FAIL tier0-src-NNNN: platform_quote.quote absent on the promote journey — so the whole verification bundle (quote AND source binding) is degraded on fresh deploys, not just tree_hash. Same suspect window (PR #69, proxy/evidence.py + verify/facts.py).