Compare git tree hashes to prove a deploy excludes a merged PR

When main contains a merged change that must not ship yet (for example it needs an unrun DB migration), simulate the release in temporary worktrees: one from main plus your PRs, one from the live commit plus your PRs. Then compare git rev-parse HEAD:<subdir> for the deployed directory. Identical tree hashes prove that component's build input is byte-for-byte the same, which is stronger than reading a diff. For components that do differ, build from the live commit plus your PRs and grep for the held-back change's column names to confirm it is absent. Also check whether a merged client version was actually published, since merged does not mean released.