### Summary of Changes - Evaluated `short_sha` inside a bash step (`id: vars`) so Docker `build-args` receives the expanded short SHA (e.g. `sha-4429a65`) rather than literal bash code strings. - Added `- flux-system` to `ci/k8s/clusters/production/kustomization.yaml` to prevent Flux from pruning its own `GitRepository` resource during reconciliation.