feat(deploy): verify each tenant /buildinfo matches published SHA after redeploy

[HongmingWang-Rabbit]

Summary

Closes #2395. The redeploy-fleet workflows currently report ssm_status=Success based on the SSM RPC return code alone — but on hongmingwang.moleculesai.app's tenant, that "Success" was firing 30+ minutes after every push while the EC2 instance kept serving the previous :latest digest. Root cause: docker compose up -d is a no-op when the local tag already resolves locally; without an explicit docker pull, "the SSM RPC didn't error" and "the new code is actually running" are different statements.

This PR makes them the same statement.

How

• New internal/buildinfo package exposes GitSHA, set at link time via -ldflags "-X .../buildinfo.GitSHA=$GIT_SHA". Default value "dev" so test runs without ldflags fail closed against an unset deploy rather than rounding-tripping "".
• Router exposes GET /buildinfo → {git_sha}. Public, no auth, cheap enough to curl from CI for every tenant.
• Both Dockerfiles thread GIT_SHA from a build-arg into the Go build line.
• publish-workspace-server-image.yml passes GIT_SHA=${{ github.sha }} for both images.
• redeploy-tenants-on-main.yml and redeploy-tenants-on-staging.yml add a "Verify each tenant /buildinfo matches published SHA" step that curls every tenant after the redeploy RPC and fails the workflow on mismatch. Staging treats both :latest and :staging-latest as moving tags. Verification is skipped only when the operator pinned a specific tag via workflow_dispatch.

Why a verify step rather than docker pull in the SSM script

Because the verify step also catches:

• partial fleet drift (one EC2 docker daemon hung; the rest pulled fine)
• container restart races (pull succeeded, container exited and restarted on the old image)
• tag-name typos in the deploy script
• the entire class of "the new code crashed on startup and supervisord rolled back"

Adding docker pull would only address one of the four. The verify step is the load-bearing fix.

Tests

• TestGitSHA_DefaultDevSentinel pins the dev default — guarantees an unset deploy always fails closed.
• TestBuildInfoEndpoint_ReturnsGitSHA pins the wire shape ({"git_sha": "..."}) that the workflow's jq lookup depends on.
• go build ./..., go vet ./..., both touched packages green.
• All three workflow YAMLs validated.

Test plan

• Merge to staging
• Watch publish-workspace-server-image build with the new GIT_SHA build-arg
• Watch redeploy-tenants-on-staging — should now hit the verify step and either green or fail with a useful diff
• On green, verify hongmingwang.moleculesai.app/buildinfo returns the new SHA

🤖 Generated with Claude Code