fix(deploy): verify Docker clone updates against the served release

Dockerfile

@@ -1,19 +1,11 @@
 # syntax=docker/dockerfile:1
-# node:alpine = latest Node within the supported LTS major (tracks the newest
-# patch automatically; currently v26.x, which satisfies package.json's
-# engines ">=26.8.1 <27").
-FROM node:alpine AS builder
+# Pin the runtime to the supported engine; update both stages deliberately.
+FROM node:26.8.1-alpine AS builder
 WORKDIR /app
 ENV NEXT_TELEMETRY_DISABLED=1
-# Real release id supplied by CI (ci-deploy.sh) so next.config.ts skips git
-# entirely (there is no .git in the build context). Defaults to "unknown".
-ARG NEXT_DEPLOYMENT_ID="unknown"
-ENV NEXT_DEPLOYMENT_ID="$NEXT_DEPLOYMENT_ID"
-# pnpm install is always pinned to the version in package.json's
-# `packageManager` field (pnpm auto-selects it on install), so this global
-# install only needs to exist as a bootstrap and follows the active major.
+# Keep the bootstrap aligned with package.json packageManager.
 RUN apk add --no-cache git \
-    && npm install -g pnpm@latest
+    && npm install -g pnpm@11.25.0
 # pnpm-workspace.yaml + .npmrc must be present too: the lockfile records the
 # overrides from pnpm-workspace.yaml, and --frozen-lockfile rejects a build
 # where the workspace config is absent (ERR_PNPM_LOCKFILE_CONFIG_MISMATCH).
@@ -23,9 +15,13 @@ COPY package.json pnpm-lock.yaml* pnpm-workspace.yaml* .npmrc* ./
 RUN pnpm fetch --ignore-scripts
 RUN pnpm install --frozen-lockfile --ignore-scripts --offline
 COPY . .
+ARG NEXT_DEPLOYMENT_ID="unknown"
+ENV NEXT_DEPLOYMENT_ID="$NEXT_DEPLOYMENT_ID"
 RUN pnpm run build
 
-FROM node:alpine AS runner
+FROM node:26.8.1-alpine AS runner
+ARG NEXT_DEPLOYMENT_ID="unknown"
+LABEL org.opencontainers.image.revision="$NEXT_DEPLOYMENT_ID"
 WORKDIR /app
 ENV NODE_ENV=production \
     NEXT_TELEMETRY_DISABLED=1 \