恢复集成(HEL-237): 并入 HEL-235 安全构建入口工具链（仅构建工具与文档，无运行时影响）

Co-authored-by: multica-agent <github@multica.ai>

tools/README.md

@@ -20,6 +20,12 @@ registry, and verification tools.
 - `python tools/backfill_recent_snapshots.py --account <admin> [--lookback 60] [--dry-run]`:
   auditable recent trading-day dashboard snapshot backfill. See
   `docs/maintenance/行情历史补档.md`.
+- `bash tools/build_image.sh <commit> <tag>`: the only sanctioned way to build the
+  production Docker image. Streams `git archive <commit>` to the deploy host over SSH
+  (default `moxiaobai@192.168.200.11`), refuses tags that do not end with the commit
+  short SHA, verifies the revision label after the build, and appends a record to
+  `~/xiaobai-build/BUILD_LOG.tsv` on the host. Building from any server-side working
+  tree is forbidden; see `DOCKER_DEPLOY.md`.
 
 `verify_baseline.py` does not inspect a parent checkout or skip tests according to files outside
 this application. Historical comparison scripts were retired after final standalone acceptance;