Pin and verify sing-box version across Harbor runtimes

.gitea/workflows/gateway-build.yml

@@ -119,8 +119,9 @@ jobs:
           docker info 2>/dev/null | sed -n '/HTTP Proxy:/p;/HTTPS Proxy:/p;/Name:/p'
 
           if ! docker image inspect "${{ env.BASE_IMAGE }}" >/dev/null 2>&1 \
-            || ! docker run --rm "${{ env.BASE_IMAGE }}" sh -lc 'command -v npm >/dev/null'; then
-            echo "Runtime base image ${{ env.BASE_IMAGE }} is missing npm; building it now."
+            || ! docker run --rm "${{ env.BASE_IMAGE }}" sh -lc \
+              'command -v npm >/dev/null && sing-box version 2>&1 | grep -Fx "sing-box version ${{ env.SINGBOX_VERSION }}"'; then
+            echo "Runtime base image ${{ env.BASE_IMAGE }} is missing npm or sing-box ${{ env.SINGBOX_VERSION }}; building it now."
             BASE_IMAGE="${{ env.RUNTIME_BASE_SOURCE_IMAGE }}" \
             RUNTIME_BASE_IMAGE="${{ env.BASE_IMAGE }}" \
             APT_MIRROR="${{ env.APT_MIRROR }}" \
@@ -143,6 +144,10 @@ jobs:
             -t "${DATAPLANE_IMAGE}:latest" \
             -t "${DATAPLANE_IMAGE}:${{ gitea.sha }}" \
             .
+          docker run --rm --entrypoint sing-box "${CONTROL_IMAGE}:${{ gitea.sha }}" version 2>&1 \
+            | grep -Fx "sing-box version ${{ env.SINGBOX_VERSION }}"
+          docker run --rm --entrypoint sing-box "${DATAPLANE_IMAGE}:${{ gitea.sha }}" version 2>&1 \
+            | grep -Fx "sing-box version ${{ env.SINGBOX_VERSION }}"
           docker push "${CONTROL_IMAGE}:latest"
           docker push "${CONTROL_IMAGE}:${{ gitea.sha }}"
           docker push "${DATAPLANE_IMAGE}:latest"
@@ -197,3 +202,7 @@ jobs:
             DATAPLANE_IMAGE="${DATAPLANE_IMAGE}" \
             UPDATE_DATAPLANE="${UPDATE_DATAPLANE}" \
             bash scripts/deploy-gateway.sh
+          VERSION_JSON="$(curl --noproxy '*' -fsS http://127.0.0.1:3456/api/version)"
+          printf '%s\n' "$VERSION_JSON"
+          printf '%s\n' "$VERSION_JSON" \
+            | grep -F "\"singBox\":\"${{ env.SINGBOX_VERSION }}\""