Bind Polymarket Rust binary identity to the exact source revision

[proerror77]

Change contract

Bind the polymarket-raw-ops binary identity to MONDAY_SOURCE_REVISION, using the existing Docker build input, so a control-only exact-main change cannot reproduce an already-pinned candidate digest and collide with immutable release controls. The published collector artifact must verify polymarket-raw-ops --version against the exact source revision.

Acceptance evidence

• polymarket-raw-ops --version is the compile-time MONDAY_SOURCE_REVISION.
• A focused test proves the CLI version is bound to that compile-time value.
• The ACR collector artifact job rejects a Polymarket binary whose version does not equal its selected source revision.
• Existing collection/upload/parity behavior is unchanged.
• The next exact-main artifact has a candidate SHA distinct from the already-pinned 9aeca5caf148b7770657b2e1017cce3f72e6bfc26e492bc63e4cc06b585d3340.

Out of scope

Gate recovery semantics, production cutover, data/snapshot/research logic, #235, and deletion or mutation of the existing immutable release.

Runtime evidence

ECS readback invocation t-jpn6s42fs4lje9s confirms /opt/monday/releases/polymarket-raw-ops/9aeca5.../control is bound to source 9b42fe..., while the exact-main e933194... artifact reproduced the same binary SHA with new release/control manifests. The current Gate would correctly reject that binding collision.