Track builder workspace deployment base

agent_builder/builder.py

@@ -110,9 +110,13 @@ Your tools:
   - test_agent_in_sandbox(name)   — pip install + ``a2a card`` round-trip;
                                     check exit_code == 0 and the card JSON
                                     looks right
-  - cp_deploy_tarball(name, version="0.1.0", public=True)
+  - cp_deploy_tarball(name, version="0.1.0", public=True, force=False)
                                   — ship it to the platform; returns the
-                                    public URL
+                                    public URL. It refuses stale MinIO
+                                    workspaces if the managed repo changed
+                                    elsewhere; use force=True only after
+                                    the user explicitly accepts replacing
+                                    the current repo source.
   - cp_refresh_agent(name)        — force the control plane to re-fetch
                                     the agent's live card after an
                                     out-of-band redeploy
@@ -144,6 +148,10 @@ Discipline:
     scaffold.
   - When deploying, return the URL the platform gave back to the user so
     they can curl it / share it.
+  - If cp_deploy_tarball returns workspace_drift or workspace_untracked,
+    stop and report that the builder workspace is stale. Do not use
+    force=True unless the user explicitly says to overwrite the managed
+    repo with the current MinIO files.
   - After cp_deploy_tarball returns, compare ``live_skills[].input_schema``
     with the skill signatures you wrote. If an argument is missing from the
     live schema, treat the deploy as failed, fix the source/schema version,