Compare prod-deployment SHA to main and ignore changes confined to .github/,
tests/, and docs/build files (which the deploy excludes) — so infra-only commits
don't trip a false 'prod behind main' alert every day.
Agent-Session: cto monitor-drift-filter