Tag built images with the commit's short hash (closes #239)

Builds are tagged upaas-<app>:<short hash>, git's own short form of
the commit checked out, instead of the deployment number.

A redeploy of a commit gives the tag to the new image. The cleanup
after a deploy now also finds the app's untagged images among those
its deployments recorded, and removes them by ID once the app neither
runs them nor would roll back to them. It keeps every image any app
uses, since apps that build the same commit can share one.

The clone reads the commits from git's output after removing Docker's
log headers, which had hidden the COMMIT: line; commit_sha is now
saved on update so manual deploys keep the commit they recorded.

Model: opus-5-5

TODO.md

@@ -20,6 +20,15 @@ regress.
 
 # Completed Steps
 
+- 2026-09-29: Built images are tagged `upaas-<app>:<short hash>`, git's short
+  form of the commit built, instead of the deployment number. A redeploy of a
+  commit gives its tag to the new image; the old one is kept while the app runs
+  it or Rollback would start it, then removed by its ID, found among the images
+  the app's deployments recorded. The removal of old images now keeps every
+  image any app runs or would roll back to. The clone now reads the commit from
+  git's output, which Docker's log headers had hidden, so manual deploys record
+  their commit too (#239).
+
 - 2026-09-29: The app page is 50% wider on large screens (84rem instead of
   56rem), its build log and container log boxes are twice as tall, the build log
   sits between the webhook URL and the environment variables, and the container