Compare prod-deployment SHA to main and ignore changes confined to .github/, tests/, and docs/build files (which the deploy excludes) — so infra-only commits don't trip a false 'prod behind main' alert every day. Agent-Session: cto monitor-drift-filter