triggerBuild() was sending branch: tagName for tag pushes. BuildBuddy's hosted-runner repo setup does an unconditional `git checkout -B <ref> origin/<ref>` after a shallow `git fetch --depth=1 origin <ref>` — that only works when <ref> resolves as a branch (the fetch populates refs/remotes/origin/<ref>). A tag ref only populates FETCH_HEAD, so origin/<ref> never exists and checkout fails with "fatal: 'origin/<ref>' is not a commit", killing the run before our own build script step ever executes. Confirmed live debugging the sif-egl-fix invocation, which hit exactly this failure mode. Fix: send commit_sha (api/v1/service.proto RunRequest field 3) instead, which pins the exact commit regardless of ref type — we always have the real sha in scope here. branch is still sent for main-branch pushes only, purely as a snapshot-affinity hint. Also adds .github/workflows/deploy-proxy-latha-org.yml (manual workflow_dispatch, same OpenBao-secrets pattern as cachix.yml) since this sandbox has no Cloudflare deploy credentials of its own — needed to actually get this fix live so a real tag push can publish an artifact to tangled. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>