fix: attribute Sentry errors to the loaded source release (#13719)

Attribute optional server and browser Sentry events to their source build.
Use validated build commits for Docker and source/npm artifacts, preserve
explicit server release overrides, and keep cached browser bundles tied
to the commit they loaded.

Verify 127 focused tests, server/UI typechecks, Docker and source build
stamps, all 53 CI checks, and Greptile 5/5 with no unresolved comments.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

server/scripts/write-build-stamp.mjs

@@ -5,7 +5,7 @@
 // report `service.version`, so the value tracks the true built commit.
 //
 // The build resolves the commit in two steps:
-//   1. `git rev-parse --short HEAD` in the server directory.
+//   1. `git rev-parse HEAD` in the server directory.
 //   2. The `PAPERCLIP_BUILD_COMMIT` environment variable.
 // A Docker image build excludes `.git`, so the git lookup fails there. The
 // image build passes the commit in `PAPERCLIP_BUILD_COMMIT` instead, so the
@@ -44,14 +44,14 @@ export function resolveBuildCommit(gitCommit, suppliedCommit) {
 }
 
 /**
- * Read the short commit SHA with `git rev-parse --short HEAD` in the server
+ * Read the full commit SHA with `git rev-parse HEAD` in the server
  * directory. Return the SHA, or null on any failure.
  *
  * @returns {string | null}
  */
 function readGitCommit() {
   try {
-    const out = execFileSync("git", ["rev-parse", "--short", "HEAD"], {
+    const out = execFileSync("git", ["rev-parse", "HEAD"], {
       cwd: serverDir,
       stdio: ["ignore", "pipe", "ignore"],
     })