fix(deploy): unblock every rebuild on BuildKit's host-network refusal

Docker 29.1.3 ships BuildKit v0.26, which refuses to grant a build host
networking unless each caller passes --allow=network.host. All three rebuild
paths asked for it, and `docker compose build` has no flag to grant it, so a
rebuild failed immediately with "additional privileges requested". The live
container was never replaced, which is exactly the reported symptom: the site
kept serving the previous release after a rebuild.

Nothing in the build actually needs host networking. It uses the network only
for apk, pnpm and next/font/google — all outbound internet, which the default
bridge provides. Verified by building both the full runner image and the
migrations stage with --no-cache after dropping the flag.

Runtime `network_mode: host` stays: blue/green needs per-release host ports
(3002/3003) and nginx reaches each slot over 127.0.0.1.

The second gap is how a rebuild could still ship the wrong code. ci-deploy.sh
stamped every image with HEAD's revision label, and verify-deployed-release.mjs
only re-checks that same label, so a dirty working tree produced an image that
claimed to be release $sha while containing uncommitted code. docker-update.sh
already refused this; ci-deploy.sh now does too, before any build work.

scripts/ci-deploy.sh

@@ -395,11 +395,27 @@ if ! grep -qs '^DATABASE_URL=' .env; then
   exit 1
 fi
 
+# De image krijgt het label van $sha, en `verify-deployed-release.mjs` controleert
+# later alleen díe label. Zonder deze check bouwt een vuile werkboom dus een image
+# die zegt release $sha te zijn terwijl er ongecommitte code in zit — precies het
+# scenario "rebuilden levert geen nieuwe code". `docker-update.sh` deed dit al.
+# `--untracked-files=normal` laat gitignored artefacten (.next, coverage,
+# build-reports) buiten beschouwing; die worden toch niet meegebouwd.
+if [ -n "$(git status --porcelain --untracked-files=normal)" ]; then
+  echo "Error: de werkboom is niet schoon, dus de image zou een verkeerd release-label krijgen." >&2
+  echo "       Commit of stash de wijzigingen en draai opnieuw." >&2
+  echo "       De live release is niet aangeraakt." >&2
+  git status --short >&2
+  exit 1
+fi
+
 pnpm install --frozen-lockfile
 pnpm exec playwright install chromium
 
 echo "Building $image"
-DOCKER_BUILDKIT=1 docker build --network=host --progress=plain --cache-from epicnext-cms:latest \
+# No --network=host: BuildKit only grants it via --allow=network.host, and the
+# build needs nothing but outbound internet (apk, pnpm, next/font/google).
+DOCKER_BUILDKIT=1 docker build --progress=plain --cache-from epicnext-cms:latest \
   --build-arg NEXT_DEPLOYMENT_ID="$sha" -t "$image" .
 check_current
 # Read reports from the already-built image; do not start an extra application.