fix(cutover): gate 1 asks Steam when public was set, not the manifest's date or staging (D332)

The 2026-11-05 weekend never cut over: gate 1 blocked every hourly run. Both of
its checks rested on assumptions the wipe disproved:

- The wipe build went live Thursday evening, but its depot manifest is dated
  11-04: the date DepotDownloader prints is when Facepunch built it.
- Public never names staging's manifest. Facepunch promotes a hidden `release`
  branch ("Release, before public"), and staging had moved on before the wipe.

Gate 1 now reads Steam's app info (steamcmd +app_info_print 258550, kept by
static.sh as appinfo.txt with BRANCH=public): branches.public.timeupdated must be
on the wipe day or later, and the Linux depot manifest Steam names for public
must be the one the static half downloaded. The staging static half is gone from
edge's cutover.yml; --staging-work is still accepted, since main's copy passes it
until the cutover merge carries the new wiring over.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014HJEmgsXtLR5kLfh7f9y8P

tools/drill/static.sh

@@ -35,7 +35,7 @@ DOTNET=${DOTNET:-dotnet}
 
 mkdir -p "$WORK"
 rm -rf "$WORK/depot" "$WORK/oxide" "$WORK/refs" "$WORK/fields"
-rm -f "$WORK"/static.json "$WORK"/oxide-behind.txt "$WORK"/fields.diff "$WORK"/compile.txt
+rm -f "$WORK"/static.json "$WORK"/oxide-behind.txt "$WORK"/fields.diff "$WORK"/compile.txt "$WORK"/appinfo.txt
 
 managed=error
 behind=-1
@@ -45,10 +45,11 @@ note=""
 oxide_modified=""
 manifest=""
 manifest_date=""
+steam_note=""
 
 finish() {
-  printf '{"branch":"%s","manifest":"%s","manifestDate":"%s","managed":"%s","oxideBehind":%s,"fields":"%s","compile":"%s","oxideModified":"%s","note":"%s"}\n' \
-    "$BRANCH" "$manifest" "$manifest_date" "$managed" "$behind" "$fields" "$compile" "$oxide_modified" "$note" > "$WORK/static.json"
+  printf '{"branch":"%s","manifest":"%s","manifestDate":"%s","managed":"%s","oxideBehind":%s,"fields":"%s","compile":"%s","oxideModified":"%s","note":"%s","steamNote":"%s"}\n' \
+    "$BRANCH" "$manifest" "$manifest_date" "$managed" "$behind" "$fields" "$compile" "$oxide_modified" "$note" "$steam_note" > "$WORK/static.json"
   cat "$WORK/static.json"
   exit 0
 }
@@ -56,6 +57,37 @@ finish() {
 # Git Bash does not translate paths inside a response file; elsewhere this is the path as it is.
 native() { if command -v cygpath > /dev/null; then cygpath -m "$1"; else printf '%s' "$1"; fi; }
 
+# ---- When Steam set the branch to its build (BRANCH=public only: the cutover's gate 1) ----
+# The depot manifest's date below is when Facepunch BUILT the build, not when it went live (the
+# 2026-11-05 wipe build was dated 11-04). Steam's app info says when the branch was SET to it
+# (depots.branches.<branch>.timeupdated) and which Linux depot manifest that is. steamcmd's whole
+# output goes to appinfo.txt; tools/drill/cutover.js reads it. A failure only leaves steamNote set,
+# and gate 1 blocks. STEAMCMD points at another steamcmd (steamcmd.sh, or steamcmd.exe on Windows).
+
+steam_info() {
+  local sc=${STEAMCMD:-} i
+  if [ -z "$sc" ]; then
+    mkdir -p "$WORK/steamcmd"
+    curl -sSL --fail https://steamcdn-a.akamaihd.net/client/installer/steamcmd_linux.tar.gz | tar -xz -C "$WORK/steamcmd" \
+      || { steam_note="steamcmd could not be fetched"; return; }
+    sc=$WORK/steamcmd/steamcmd.sh
+  fi
+  # steamcmd updates itself on its first start and then may print nothing, so it gets three tries.
+  # It is 32-bit: a bare runner image lacks its libgcc, which is installed after the first miss.
+  for i in 1 2 3; do
+    "$sc" +login anonymous +app_info_update 1 +app_info_print 258550 +quit > "$WORK/appinfo.txt" 2>&1
+    grep -q '^"258550"' "$WORK/appinfo.txt" && return
+    if [ "$i" = 1 ] && command -v apt-get > /dev/null && [ "$(id -u)" = 0 ]; then
+      { apt-get update -qq && apt-get install -y -qq lib32gcc-s1; } > "$WORK/steamcmd-deps.txt" 2>&1
+    fi
+  done
+  steam_note="steamcmd printed no app info: $(tail -2 "$WORK/appinfo.txt" | tr '\n"\\' '   ')"
+}
+
+if [ "$BRANCH" = public ]; then
+  steam_info
+fi
+
 # ---- Rust's managed assemblies, from Steam (no login: the dedicated server is anonymous) ----
 
 DD=${DEPOTDOWNLOADER:-}