fix(image): add AGNES_COMMIT_SHA build-arg to Dockerfile + release.yml

Completes the previous commit — bakes the full git SHA into the image ENV
at build time so the UI badge shows a real commit, not a sha256 digest
(which was the floating manifest digest and unhelpful for debugging).

.github/workflows/release.yml

@@ -115,6 +115,7 @@ jobs:
           build-args: |
             AGNES_VERSION=${{ steps.meta.outputs.version }}
             RELEASE_CHANNEL=${{ steps.meta.outputs.channel }}
+            AGNES_COMMIT_SHA=${{ github.sha }}
           tags: |
             ghcr.io/${{ github.repository }}:${{ steps.meta.outputs.channel }}
             ghcr.io/${{ github.repository }}:${{ steps.meta.outputs.versioned_tag }}

Dockerfile

@@ -8,8 +8,10 @@ COPY --from=ghcr.io/astral-sh/uv:latest /uv /usr/local/bin/uv
 
 ARG AGNES_VERSION=dev
 ARG RELEASE_CHANNEL=dev
+ARG AGNES_COMMIT_SHA=unknown
 ENV AGNES_VERSION=${AGNES_VERSION}
 ENV RELEASE_CHANNEL=${RELEASE_CHANNEL}
+ENV AGNES_COMMIT_SHA=${AGNES_COMMIT_SHA}
 
 WORKDIR /app