A silently ignored alias pointed a verification probe at production

rsbuild accepts source.alias and ignores it. Three agents rendered live data believing it was a fixture; one wrote a file into client corpus.