fix(deploy): verify Docker clone updates against the served release

src/lib/docker-build-contract.test.ts

@@ -29,3 +29,16 @@ describe("Docker build cache", () => {
 		expect(dockerfile).not.toContain("yarn install --production");
 	});
 });
+
+it("passes a compiled release to both the application build and final image", () => {
+	expect(dockerfile.indexOf("ARG NEXT_DEPLOYMENT_ID")).toBeGreaterThan(
+		dockerfile.indexOf("COPY . ."),
+	);
+	expect(dockerfile).toContain(
+		'LABEL org.opencontainers.image.revision="$NEXT_DEPLOYMENT_ID"',
+	);
+	expect(dockerfile.match(/FROM node:26\.8\.1-alpine/g)).toHaveLength(2);
+	const compose = readFileSync("docker-compose.yml", "utf8");
+	// biome-ignore lint/suspicious/noTemplateCurlyInString: Docker Compose interpolation, not JavaScript.
+	expect(compose).toContain("NEXT_DEPLOYMENT_ID: ${CMS_RELEASE:-unknown}");
+});