Tag built images with the commit's short hash (closes #239)

Builds are tagged upaas-<app>:<short hash>, git's own short form of
the commit checked out, instead of the deployment number.

A redeploy of a commit gives the tag to the new image. The cleanup
after a deploy now also finds the app's untagged images among those
its deployments recorded, and removes them by ID once the app neither
runs them nor would roll back to them. It keeps every image any app
uses, since apps that build the same commit can share one.

The clone reads the commits from git's output after removing Docker's
log headers, which had hidden the COMMIT: line; commit_sha is now
saved on update so manual deploys keep the commit they recorded.

Model: opus-5-5

internal/service/deploy/deploy_build_test.go

@@ -34,6 +34,8 @@ func TestBuildImageLogsBuildErrorBeforeDeployError(t *testing.T) {
 			switch {
 			case strings.HasSuffix(r.URL.Path, "/containers/create"):
 				_, _ = w.Write([]byte(`{"Id":"gitcontainer"}`))
+			case strings.HasSuffix(r.URL.Path, "/logs"):
+				writeCloneOutput(w, "abc1234")
 			case strings.HasSuffix(r.URL.Path, "/version"):
 				_, _ = w.Write([]byte(`{"Version":"27.3.1","ApiVersion":"1.47"}`))
 			case strings.HasSuffix(r.URL.Path, "/build"):
@@ -77,7 +79,7 @@ func TestBuildImageLogsBuildErrorBeforeDeployError(t *testing.T) {
 
 	// The service has no notify service: the app has no ntfy topic and no
 	// Slack webhook, so the build failure notification sends nothing.
-	svc := deploy.NewTestServiceWithConfig(log, cfg, dockerClient)
+	svc := deploy.NewTestServiceWithConfig(log, cfg, db, dockerClient)
 
 	_, err = svc.BuildImage(ctx, app, deployment)
 	require.EqualError(t, err, "failed to build image: exit code: 1")