Tag built images with the commit's short hash (closes #239)

Builds are tagged upaas-<app>:<short hash>, git's own short form of
the commit checked out, instead of the deployment number.

A redeploy of a commit gives the tag to the new image. The cleanup
after a deploy now also finds the app's untagged images among those
its deployments recorded, and removes them by ID once the app neither
runs them nor would roll back to them. It keeps every image any app
uses, since apps that build the same commit can share one.

The clone reads the commits from git's output after removing Docker's
log headers, which had hidden the COMMIT: line; commit_sha is now
saved on update so manual deploys keep the commit they recorded.

Model: opus-5-5

TODO.md

@@ -20,6 +20,15 @@ regress.
 
 # Completed Steps
 
+- 2026-09-29: Built images are tagged `upaas-<app>:<short hash>`, git's short
+  form of the commit built, instead of the deployment number. A redeploy of a
+  commit gives its tag to the new image; the old one is kept while the app runs
+  it or Rollback would start it, then removed by its ID, found among the images
+  the app's deployments recorded. The removal of old images now keeps every
+  image any app runs or would roll back to. The clone now reads the commit from
+  git's output, which Docker's log headers had hidden, so manual deploys record
+  their commit too (#239).
+
 - 2026-09-29: A failed build now fails the deploy with the build's own error
   instead of a later "failed to inspect image", and the deployment log shows the
   end of the build output before that error. upaas refuses to build on a Docker