Deploy green but prod serves stale image (2x on 2026-07-06); needs post-deploy digest assert

[vreshch]

Twice on 2026-07-06 the master Deploy run finished green while prod kept serving the previous image (dev correct both times):

• Run 28797138706 - /docs/cli served the old flag docs after the fix(docs): vault add uses --local [path], no --path flag #45 merge
• Run 28821129822 - /docs/rest-api served pre-docs(rest-api): wave-2 endpoints live + error envelope + llms coverage #50 content (no error-envelope block) while dev.agentage.io had it

Recovery both times: gh run rerun converged prod within minutes, so the image is fine and only the prod service update is not taking effect on the first pass (suspect: same-digest-tag race or service update returning before rollout, matrix [dev,prod] sharing one image tag).

Acceptance: a green Deploy run guarantees prod serves the new build - either verify the running container digest/commit as a post-deploy step and fail the job when stale, or force the service update. See web repo's /health commit-assert pattern.