What is the supported read-only method to establish deployment package provenance and exclusive routing during deployment replacement and rollback?

1. Can existing authenticated CLI/API access produce a provider-backed manifest, file hashes, or export that binds an immutable deployment/image to the complete application package, including support files? If no retained repository/build manifest is available and SSH is not enabled, is there a provider-assisted read-only route? Please distinguish deployment configuration metadata from full filesystem/source binding. No new credentials or live changes are requested.

2. Which documented API fields or logs establish when an old deployment stops receiving new traffic, when existing WebSocket connections are drained or terminated, and when the replacement is the sole routed owner? What are the consistency/timing guarantees and overlap behavior?

3. Can the same observations prove withdrawal and sole activation during rollback? Please identify any supported drain/fencing/switch procedure and how its evidence can be correlated to deployment/instance identities privately.

This is a question about supported platform evidence methods, not an application-debugging request. A current single-instance snapshot or a general zero-downtime claim does not establish transition behavior. Please link official documentation or explain the minimum private provider-assisted route if required. No account, project, deployment identifiers, secrets, source code, or logs are included here.