fix(docker): bake CI tag into image, prefer it at runtime

The v1.4.42 docker-publish workflow shipped a stale package.json version
baked into the bundle because BuildKit reused the pnpm build layer
across the release tag bump -- the COPY . . layer key was content-stable
relative to the prior build, the layer was warm, and the runtime
/api/version read the cached package.json content instead of the new
tag.

Thread github.ref_name through as a NEXT_PUBLIC_APP_VERSION build-arg
from docker-publish.yml. The Dockerfile picks it up as an ARG/ENV in
both the builder and runner stages and bakes it into the build context.
src/app/api/version/route.ts now reads the env var first and falls
through to package.json only when unset (local pnpm dev). The build-arg
becomes part of the layer cache key, so every release tag invalidates
every downstream layer and the runtime version can never drift from
the tag the workflow ran on.

.github/workflows/docker-publish.yml

@@ -194,6 +194,15 @@ jobs:
           file: ./Dockerfile
           platforms: ${{ matrix.platform }}
           labels: ${{ steps.meta.outputs.labels }}
+          # v1.4.43 B11 — thread the tag ref into the build as
+          # NEXT_PUBLIC_APP_VERSION. The Dockerfile picks it up as an
+          # ARG/ENV and /api/version reads it at runtime. The build-arg
+          # becomes part of the BuildKit layer cache key, so a release
+          # tag bump invalidates every downstream layer that depends on
+          # it (`pnpm build`) and the prior release's version string
+          # can never survive a cache hit into the new image.
+          build-args: |
+            NEXT_PUBLIC_APP_VERSION=${{ github.ref_name }}
           outputs: |
             type=image,name=${{ env.IMAGE_REF }},push-by-digest=true,name-canonical=true,push=${{ github.event_name != 'pull_request' }}
           cache-from: |