fix: attribute Sentry errors to the loaded source release (#13719)

Attribute optional server and browser Sentry events to their source build.
Use validated build commits for Docker and source/npm artifacts, preserve
explicit server release overrides, and keep cached browser bundles tied
to the commit they loaded.

Verify 127 focused tests, server/UI typechecks, Docker and source build
stamps, all 53 CI checks, and Greptile 5/5 with no unresolved comments.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

server/src/__tests__/build-commit.test.ts

@@ -15,6 +15,28 @@ describe("parseBuildCommit", () => {
 });
 
 describe("readBuildCommit", () => {
+  it("reads the built server stamp in npm packages without a deployment marker", () => {
+    const commit = "0123456789abcdef0123456789abcdef01234567";
+    expect(readBuildCommit({
+      environmentCommit: null,
+      buildCommitPath: "/app/.paperclip-build-commit",
+      buildInfoPath: "/app/server/dist/build-info.json",
+      readTextFile: (path) => {
+        if (path.endsWith(".paperclip-build-commit")) throw new Error("ENOENT");
+        return JSON.stringify({ commit });
+      },
+    })).toBe(commit);
+  });
+
+  it.each(["invalid json", "null", '{"commit":"short"}', '{"commit":42}'])(
+    "fails open on an invalid server stamp: %s", (stamp) => {
+      expect(readBuildCommit({
+        environmentCommit: null,
+        readTextFile: () => stamp,
+      })).toBeNull();
+    },
+  );
+
   it("prefers an explicit environment commit", () => {
     const readTextFile = vi.fn(() => "ffffffffffffffffffffffffffffffffffffffff");