fix(deploy): unblock every rebuild on BuildKit's host-network refusal

Docker 29.1.3 ships BuildKit v0.26, which refuses to grant a build host
networking unless each caller passes --allow=network.host. All three rebuild
paths asked for it, and `docker compose build` has no flag to grant it, so a
rebuild failed immediately with "additional privileges requested". The live
container was never replaced, which is exactly the reported symptom: the site
kept serving the previous release after a rebuild.

Nothing in the build actually needs host networking. It uses the network only
for apk, pnpm and next/font/google — all outbound internet, which the default
bridge provides. Verified by building both the full runner image and the
migrations stage with --no-cache after dropping the flag.

Runtime `network_mode: host` stays: blue/green needs per-release host ports
(3002/3003) and nginx reaches each slot over 127.0.0.1.

The second gap is how a rebuild could still ship the wrong code. ci-deploy.sh
stamped every image with HEAD's revision label, and verify-deployed-release.mjs
only re-checks that same label, so a dirty working tree produced an image that
claimed to be release $sha while containing uncommitted code. docker-update.sh
already refused this; ci-deploy.sh now does too, before any build work.

docker-compose.yml

@@ -3,12 +3,19 @@
 # ─────────────────────────────────────────────────────────────────────────────
 x-cms: &cms
   image: epicnext-cms:${CMS_RELEASE:-local}
+  # No `network: host` on the build. BuildKit (v0.26, Docker 29) refuses to grant
+  # host networking unless every caller passes --allow=network.host, and
+  # `docker compose build` has no such flag — so asking for it here turned every
+  # rebuild into an immediate "additional privileges requested" failure, which
+  # left the previous release serving traffic. The build only needs outbound
+  # internet (apk, pnpm, next/font/google), which the default bridge provides.
   build:
     context: .
     dockerfile: Dockerfile
     args:
       NEXT_DEPLOYMENT_ID: ${CMS_RELEASE:-unknown}
-    network: host
+  # Runtime host networking IS required: blue/green needs per-release host ports
+  # (3002/3003) and nginx reaches the slot over 127.0.0.1.
   network_mode: host
   stop_grace_period: 15s
   restart: unless-stopped