Harden hosted deploy source checks

scripts/deploy-web.ps1

@@ -18,11 +18,28 @@ function ConvertTo-BashSingleQuoted([string]$Value) {
   return "'" + $Value.Replace("'", "'\''") + "'"
 }
 
+function Assert-CleanPushedRepo([string]$Path, [string]$Name) {
+  git -C $Path fetch origin main
+  if ($LASTEXITCODE -ne 0) { throw "$Name fetch failed." }
+
+  $status = git -C $Path status --porcelain
+  if ($status) { throw "$Name has uncommitted changes. Commit or revert them before deploying." }
+
+  $head = (git -C $Path rev-parse HEAD).Trim()
+  $origin = (git -C $Path rev-parse origin/main).Trim()
+  if ($head -ne $origin) {
+    throw "$Name HEAD $head does not match origin/main $origin. Push the repo before deploying."
+  }
+
+  return $head
+}
+
 $repoRoot = Split-Path -Parent $PSScriptRoot
 $dataRepo = Resolve-Path (Join-Path $repoRoot "..\libre-bible-data")
+$commit = Assert-CleanPushedRepo $repoRoot "Libre Study"
+$dataCommit = Assert-CleanPushedRepo $dataRepo "LibreBible data"
 $repoRootWsl = ConvertTo-WslPath $repoRoot
 $dataRepoWsl = ConvertTo-WslPath $dataRepo
-$commit = (git -C $repoRoot rev-parse HEAD).Trim()
 $deployedAt = (Get-Date).ToUniversalTime().ToString("o")
 
 Push-Location $repoRoot
@@ -41,8 +58,10 @@ finally {
 
 $deployInfo = @{
   commit = $commit
+  libreBibleDataCommit = $dataCommit
   deployedAt = $deployedAt
   source = "libre-study"
+  sourceRemote = "origin/main"
 } | ConvertTo-Json -Compress
 $deployInfoPath = Join-Path $env:TEMP "libre-study-deploy-info.json"
 Set-Content -Path $deployInfoPath -Value $deployInfo -NoNewline