fix(deploy): verify Docker clone updates against the served release

scripts/ci-deploy.sh

@@ -74,11 +74,6 @@ pnpm install --frozen-lockfile
 pnpm exec playwright install chromium
 
 echo "Building $image"
-# Throw away the previous build cache before each build so disk usage doesn't
-# grow unbounded across deployments. The current release image (`epicnext-cms`)
-# is still reused as a base layer via `--cache-from`; only the accumulated
-# BuildKit intermediate cache is discarded.
-docker builder prune -af --filter "until=1h" --keep-storage=0 2>/dev/null || true
 DOCKER_BUILDKIT=1 docker build --network=host --progress=plain --cache-from epicnext-cms:latest \
   --build-arg NEXT_DEPLOYMENT_ID="$sha" -t "$image" .
 check_current
@@ -136,6 +131,7 @@ candidate_attempted=1
     "$image"
 )
 healthy
+node --input-type=module -e 'const r=await fetch("http://127.0.0.1:3002/api/health",{cache:"no-store",signal:AbortSignal.timeout(5000)});const d=await r.json();if(!r.ok||d.release!==process.argv[1]){console.error("Release mismatch",d.release,process.argv[1]);process.exit(1)}' "$sha"
 PLAYWRIGHT_BASE_URL=http://127.0.0.1:3002 pnpm test:e2e
 # Publish the latest alias only after health and browser checks pass.
 docker tag "$image" epicnext-cms:latest