Close a release with smoke and rollback evidence

Building an image does not prove that users can use a healthy path. Bind the tested commit to the running image and run a real DB-reading smoke after readiness.

1. Require a clean worktree and explicit services.
2. Build or reuse the Git-SHA image.
3. Replace only target services with --no-deps --force-recreate.
4. Check container readiness and each service's real read smoke.
5. On failure, restore the previous image as a rollback tag and re-check readiness.

Codingstairs Docker SSR and the Fly static mirror are separate artifacts. A DB-only change can leave Fly with an old export, so verify Admin seed, Docker public reads, export contents, fly deploy --no-cache, and both locale routes separately. Preserve success and rollback logs with the release tag.

Related course: Bind a verified commit to a release and image