Label the commit date "commit date" in version and banner (closes #409)

vaultik version printed globals.CommitDate, the date of the commit the binary was built from, labelled "build date", and the startup banner called it "built on". Both now say "commit date". The test sets Commit and CommitDate to distinct values and checks the label, padding and value of every report line.

Model: opus-5-5

internal/cli/entry_banner_test.go

@@ -13,6 +13,7 @@ import (
 	"github.com/adrg/xdg"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
+	"sneak.berlin/go/vaultik/internal/globals"
 )
 
 // Command words and flags used to build argument vectors below. They are
@@ -112,6 +113,35 @@ func TestBannerStillPrintedWithoutSuppressingFlag(t *testing.T) {
 	}
 }
 
+// TestBannerLabelsCommitDate checks that the banner prints the commit
+// and the commit date, each after its own label. Commit and CommitDate
+// get different values, so printing the wrong one fails.
+//
+//nolint:paralleltest // sets globals.Commit and globals.CommitDate
+func TestBannerLabelsCommitDate(t *testing.T) {
+	const (
+		commit     = "abc1234"
+		commitDate = "2026-11-09"
+	)
+
+	previousCommit, previousCommitDate := globals.Commit, globals.CommitDate
+
+	t.Cleanup(func() {
+		globals.Commit = previousCommit
+		globals.CommitDate = previousCommitDate
+	})
+
+	globals.Commit = commit
+	globals.CommitDate = commitDate
+
+	var banner bytes.Buffer
+
+	emitStartupBanner(nil, &banner)
+
+	assert.Contains(t, banner.String(),
+		"(commit "+commit+", commit date "+commitDate+")")
+}
+
 // TestBannerSuppressedInArgs covers the suppression scan directly,
 // including the flags that suppressed the banner before --json joined
 // them, so that adding --json cannot regress them.