feat(atlas): per-job CI status + build-injected version in the UI

Phase C: the CI stage now shows the latest run's per-JOB status (Lint/Test,
Build, Deploy, …), each coloured by outcome, from the Gitea /actions/tasks
per-job entries — replacing the static cd.yml job-id list when live.
LatestRunJobs/RunNodes + RunSummary.State aggregate, all test-first.

Version: injected at build via -ldflags from `git describe --tags` (CI checkout
now fetch-depth:0 + --build-arg), served in /api/atlas.json, shown in the header.
No more hand-maintained version label drifting from the git tag.

Verified: build/vet/lint(0)/test green; version ldflag served correctly.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

.gitea/workflows/cd.yml

@@ -62,18 +62,23 @@ jobs:
       image-tag: ${{ steps.meta.outputs.sha-tag }}
     steps:
       - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0   # full history + tags so `git describe` sees the SemVer tag
 
       - name: Derive image tags
         id: meta
         run: |
           SHA=$(git rev-parse --short HEAD)
+          VERSION=$(git describe --tags --always --dirty)
           echo "sha-tag=${SHA}" >> "$GITHUB_OUTPUT"
+          echo "version=${VERSION}" >> "$GITHUB_OUTPUT"
 
       - name: Build and push to local registry
         run: |
           REGISTRY="localhost:5000"
           REF="${REGISTRY}/${{ env.IMAGE }}:${{ steps.meta.outputs.sha-tag }}"
           buildah build \
+            --build-arg VERSION="${{ steps.meta.outputs.version }}" \
             --label "org.opencontainers.image.revision=${{ github.sha }}" \
             -t ${REF} \
             -t ${REGISTRY}/${{ env.IMAGE }}:latest \