fix(deploy): verify Docker clone updates against the served release

docker-compose.yml

@@ -1,8 +1,11 @@
 services:
   cms:
+    image: epicnext-cms:${CMS_RELEASE:-local}
     build:
       context: .
       dockerfile: Dockerfile
+      args:
+        NEXT_DEPLOYMENT_ID: ${CMS_RELEASE:-unknown}
       # The host disables Docker iptables (daemon.json: "iptables": false), so
       # build containers on the bridge network have no outbound NAT/DNS. Build on
       # the host network instead so pnpm/npm/yarn can reach the registry.