test_checkout_sha_mismatch_fails_before_upload guarded the removed SOURCE_SHA == GITHUB_SHA hard check. Under a ref override the two intentionally diverge; the manifest now advertises the checked-out HEAD, so assert exactly that.