deploy: stamp images with their git revision and expose it from /healthz, so a deploy can be verified mechanically

[Xore]

What

Deploy verification today is manual inference: compare docker images creation time with the merge time, or grep a string out of the shipped binary. docs/ARCANE-GIT-SYNC.md already documents the failure mode ("green, healthy, running the old code").

• apiary-backend:latest on the homeserver has Labels: null and Created 2026-09-08T21:00. Every backend merge since then, including fix(backend): migrate rand call sites to 0.10 #3300, is undeployed, and nothing surfaces that.
• backend-service /healthz returns {ok: true, es: <bool>} with no version or commit.

Proposal

• Build arg GIT_SHA → LABEL org.opencontainers.image.revision=$GIT_SHA (+ .created, .source) in the backend-service and frontend-next Dockerfiles. Arcane builds pass it from the synced checkout.
• Backend: embed the SHA at compile time (env!/option_env!) and return it from /healthz ({ok, es, revision}). Frontend: same through a static /build.json or response header.
• Docs + a scripts/verify-deploy.sh <expected-sha> that compares the live /healthz revision and the image labels against origin/main. Diagnostics can then warn when the deployed revision lags main by more than N days.

Sources

• docs/ops/RELEASE_CHECKLIST.md
• docs/ops/MONITORING_GUIDE.md
• docs/ops/BRANCHING_MODEL.md
  RELEASE_CHECKLIST's "Artifact Validation"/"Deploy" sections: dist/BUILD_SHA == git rev-parse --short HEAD before and after deploy.

Found by the #3194 OmniRoute ops/CI deep-check (pinned 18bbb101, APIARY main 3dca4457).

[Xore]

Resolved by a merged PR (#3412 / #3402 / #3372 / #3389 / #3393). Closing.